linux-kernel - Re: [PATCH] selinux: services: cleanup orphan keywords in audit log text

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <2323471.BcNNgvtlxN@sifl>
Date:	Mon, 22 Sep 2014 17:11:09 -0400
From:	Paul Moore <pmoore@...hat.com>
To:	Richard Guy Briggs <rgb@...hat.com>
Cc:	linux-security-module@...r.kernel.org, selinux@...ho.nsa.gov,
	linux-audit@...hat.com, linux-kernel@...r.kernel.org,
	eparis@...hat.com, sgrubb@...hat.com
Subject: Re: [PATCH] selinux: services: cleanup orphan keywords in audit log text

On Thursday, September 18, 2014 08:47:48 PM Richard Guy Briggs wrote:
> Restructure to keyword=value pairs without spaces.  Drop superfluous words
> in text.  Make invalid_context a keyword.  Change result= keyword to
> seresult=.
> 
> Signed-off-by: Richard Guy Briggs <rgb@...hat.com>
> ---
>  security/selinux/ss/services.c |   14 ++++++++------
>  1 files changed, 8 insertions(+), 6 deletions(-)

Applied with a minor rewrite to the subject line.

> diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
> index 4bca494..e822910 100644
> --- a/security/selinux/ss/services.c
> +++ b/security/selinux/ss/services.c
> @@ -728,7 +728,7 @@ static int security_validtrans_handle_fail(struct
> context *ocontext, if (context_struct_to_string(tcontext, &t, &tlen))
>  		goto out;
>  	audit_log(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR,
> -		  "security_validate_transition:  denied for"
> +		  "op=security_validate_transition seresult=denied"
>  		  " oldcontext=%s newcontext=%s taskcontext=%s tclass=%s",
>  		  o, n, t, sym_name(&policydb, SYM_CLASSES, tclass-1));
>  out:
> @@ -877,7 +877,7 @@ int security_bounded_transition(u32 old_sid, u32
> new_sid) audit_log(current->audit_context,
>  				  GFP_ATOMIC, AUDIT_SELINUX_ERR,
>  				  "op=security_bounded_transition "
> -				  "result=denied "
> +				  "seresult=denied "
>  				  "oldcontext=%s newcontext=%s",
>  				  old_name, new_name);
>  		}
> @@ -1351,8 +1351,8 @@ static int compute_sid_handle_invalid_context(
>  	if (context_struct_to_string(newcontext, &n, &nlen))
>  		goto out;
>  	audit_log(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR,
> -		  "security_compute_sid:  invalid context %s"
> -		  " for scontext=%s"
> +		  "op=security_compute_sid invalid_context=%s"
> +		  " scontext=%s"
>  		  " tcontext=%s"
>  		  " tclass=%s",
>  		  n, s, t, sym_name(&policydb, SYM_CLASSES, tclass-1));
> @@ -2584,8 +2584,10 @@ int security_sid_mls_copy(u32 sid, u32 mls_sid, u32
> *new_sid) rc = convert_context_handle_invalid_context(&newcon);
>  		if (rc) {
>  			if (!context_struct_to_string(&newcon, &s, &len)) {
> -				audit_log(current->audit_context, GFP_ATOMIC, 
AUDIT_SELINUX_ERR,
> -					  "security_sid_mls_copy: invalid context %s", s);
> +				audit_log(current->audit_context,
> +					  GFP_ATOMIC, AUDIT_SELINUX_ERR,
> +					  "op=security_sid_mls_copy "
> +					  "invalid_context=%s", s);
>  				kfree(s);
>  			}
>  			goto out_unlock;

-- 
paul moore
security and virtualization @ redhat

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/