linux-kernel - [GIT PULL] Audit patches for v5.7

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 30 Mar 2020 17:53:45 -0400
From:   Paul Moore <paul@...l-moore.com>
To:     Linus Torvalds <torvalds@...ux-foundation.org>
Cc:     linux-audit@...hat.com, linux-kernel@...r.kernel.org
Subject: [GIT PULL] Audit patches for v5.7

Hi Linus,

We've got two audit patches for the v5.7 merge window with a stellar
14 lines changed between the two patches.  The patch descriptions are
far more lengthy than the patches themselves, which is a very good
thing for patches this size IMHO.  The patches pass our test suites
and a quick summary is below, please merge for v5.7.

- Stop logging inode information when updating an audit file watch.
Since we are not changing the inode, or the fact that we are watching
the associated file, the inode information is just noise that we can
do without.

- Fix a problem where mandatory audit records were missing their
accompanying audit records (e.g. SYSCALL records were missing).  The
missing records often meant that we didn't have the necessary context
to understand what was going on when the event occurred.

Thanks,
-Paul

--
The following changes since commit bb6d3fb354c5ee8d6bde2d576eb7220ea09862b9:

 Linux 5.6-rc1 (2020-02-09 16:08:48 -0800)

are available in the Git repository at:

 git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit.git
   tags/audit-pr-20200330

for you to fetch changes up to 1320a4052ea11eb2879eb7361da15a106a780972:

 audit: trigger accompanying records when no rules present
   (2020-03-12 10:42:51-0400)

----------------------------------------------------------------
audit/stable-5.7 PR 20200330

----------------------------------------------------------------
Richard Guy Briggs (1):
     audit: trigger accompanying records when no rules present

Steve Grubb (1):
     audit: CONFIG_CHANGE don't log internal bookkeeping as an event

kernel/audit.c       | 1 +
kernel/audit.h       | 8 ++++++++
kernel/audit_watch.c | 2 --
kernel/auditsc.c     | 3 ---
4 files changed, 9 insertions(+), 5 deletions(-)

-- 
paul moore
www.paul-moore.com