linux-kernel - Re: [PATCH v3] audit: Turn off TIF_SYSCALL

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 10 Feb 2014 12:47:21 -0500
From:	Steve Grubb <sgrubb@...hat.com>
To:	Andy Lutomirski <luto@...capital.net>
Cc:	Oleg Nesterov <oleg@...hat.com>, linux-audit@...hat.com,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	Andi Kleen <andi@...stfloor.org>,
	Eric Paris <eparis@...hat.com>
Subject: Re: [PATCH v3] audit: Turn off TIF_SYSCALL_AUDIT when there are no rules

On Monday, February 10, 2014 09:29:19 AM Andy Lutomirski wrote:
> Grr.  Why is all this crap tied up with syscall auditing anyway?  ISTM
> it would have been a lot nicer if audit calls just immediately emitted
> audit records, completely independently of the syscall machinery.

Because the majority of people needing audit need syscall records for it to 
make any sense. The auxiliary records generally report on the object of the 
syscall. We still require information about who was doing something, what they 
were doing, and what the result was. 

Even if you just get the AVC's, you still don't know what happened. If you get 
a deny record, was it really denied? The system could have been in permissive 
mode and the syscall succeeded. You only get the real decision when you have 
syscall records.

-Steve
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/