linux-kernel - Re: [PATCH] audit: skip sessionid sentinel value when auto-incrementing

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAHC9VhROPdGnsUKvOWwCpPDH3w5gkqPgO0ehzKjNeFASc-vjtA@mail.gmail.com>
Date:   Sun, 20 Nov 2016 15:34:24 -0500
From:   Paul Moore <paul@...l-moore.com>
To:     Richard Guy Briggs <rgb@...hat.com>
Cc:     linux-audit@...hat.com, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] audit: skip sessionid sentinel value when auto-incrementing

On Thu, Nov 17, 2016 at 9:27 PM, Richard Guy Briggs <rgb@...hat.com> wrote:
> On 2016-11-17 18:34, Paul Moore wrote:
>> On Tue, Nov 15, 2016 at 3:49 AM, Richard Guy Briggs <rgb@...hat.com> wrote:
>> > On 2016-11-14 15:17, Paul Moore wrote:
>> >> On Thu, Nov 10, 2016 at 1:41 AM, Richard Guy Briggs <rgb@...hat.com> wrote:
>> >> > The value (unsigned int)-1 is used as a sentinel to indicate the
>> >> > sessionID is unset.  Skip this value when the session_id value wraps.
>> >> >
>> >> > Signed-off-by: Richard Guy Briggs <rgb@...hat.com>
>> >> > ---
>> >> >  kernel/auditsc.c |    5 ++++-
>> >> >  1 files changed, 4 insertions(+), 1 deletions(-)
>> >>
>> >> Since we haven't merged the session ID kernel patches into audit#next
>> >> yet, why don't you just squash this patch in with the session ID patch
>> >> and resubmit upstream in one nice neat patch.
>> >
>> > This was an existing bug regardless of new functionality added, so the
>> > fix should not be buried in a new feature patch.
>>
>> No, it's not an existing bug.  The existing code simply reports/logs
>> the session ID, it doesn't filter on it, so there are no magic values
>> to worry about.
>
> The existing code autoincrements through sessionID==-1.  The existing
> code (ausearch and aureport) reports and logs the sessionID and there
> are existing reporting tools that are able to filter on sessionID even
> though kernel filters don't yet exist for them.  Therefore, it is
> possible for the counter to roll and to erroneously report that the
> value is unset.

I hadn't realize that the audit userspace was using this as an unset
value.  Anyway, merged.

-- 
paul moore
www.paul-moore.com