linux-kernel - Re: [PATCH ghak59 V3 0/4] audit: config_change normalizations and event record gathering

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAHC9VhSkKqdm=q5r4Y0-kEg2j84-AG5omo6frfORXVcJ_orUaw@mail.gmail.com>
Date:   Tue, 11 Dec 2018 18:26:42 -0500
From:   Paul Moore <paul@...l-moore.com>
To:     rgb@...hat.com
Cc:     linux-kernel@...r.kernel.org, linux-audit@...hat.com,
        Eric Paris <eparis@...hat.com>, viro@...iv.linux.org.uk,
        sgrubb@...hat.com
Subject: Re: [PATCH ghak59 V3 0/4] audit: config_change normalizations and
 event record gathering

On Tue, Dec 11, 2018 at 5:41 PM Richard Guy Briggs <rgb@...hat.com> wrote:
> On 2018-12-11 17:31, Paul Moore wrote:
> > On Mon, Dec 10, 2018 at 5:18 PM Richard Guy Briggs <rgb@...hat.com> wrote:

...

> > > Richard Guy Briggs (4):
> > >   audit: give a clue what CONFIG_CHANGE op was involved
> > >   audit: add syscall information to CONFIG_CHANGE records
> > >   audit: hand taken context to audit_kill_trees for syscall logging
> > >   audit: extend config_change mark/watch/tree rule changes
> > >
> > >  kernel/audit.c          | 33 +++++++++++++++++++++++----------
> > >  kernel/audit.h          |  4 ++--
> > >  kernel/audit_fsnotify.c |  4 ++--
> > >  kernel/audit_tree.c     | 28 +++++++++++++++-------------
> > >  kernel/audit_watch.c    |  8 +++++---
> > >  kernel/auditfilter.c    |  2 +-
> > >  kernel/auditsc.c        | 12 ++++++------
> > >  7 files changed, 54 insertions(+), 37 deletions(-)
> >
> > In order to make sure expectations are set appropriately, as we are at
> > -rc6 right now this is not something that would go into audit/next now
> > (assuming everything looks okay on review), it would go into
> > audit/next *after* the upcoming merge window.
>
> I agree it is a bit late for this.  I wasn't expecting it to go in this
> one.  I'm filling the queue since I'm blocked on other review for
> ghak81(5.5wks), ghak90(5.5wks), ghak100(3.5wks).  ghak90 missed another
> merge window.

As discussed previously, GHAK81
(https://github.com/linux-audit/audit-kernel/issues/81) is something
that I consider part of the audit container ID work (GHAK90).  I
believe it's time to stop treating it as a separate issue.

The audit container ID work, GHAK90
(https://github.com/linux-audit/audit-kernel/issues/90), is where all
the dragon's lie.  That one takes a good deal of time to review, and
quite frankly I'm really the only one who seems to be looking at it
anymore, so it takes a bit longer.

Beside the fact that GHAK100
(https://github.com/linux-audit/audit-kernel/issues/100) was marked as
a RFC, I've been waiting to hear back from the VFS folks if they are
comfortable with it.  Miklos Szeredi in particular had some concerns
and it isn't clear to me from that thread that his concerns have been
resolved.

-- 
paul moore
www.paul-moore.com