Re: [PATCH ALT4 V2 2/2] audit: filter PATH records keyed on filesystem magic

2017-06-28 Thread Richard Guy Briggs
On 2017-06-28 15:08, Paul Moore wrote: > On Tue, Jun 27, 2017 at 4:45 PM, Richard Guy Briggs wrote: > > On 2017-05-30 17:30, Paul Moore wrote: > >> On Tue, Apr 4, 2017 at 5:21 AM, Richard Guy Briggs wrote: > >> > Tracefs or debugfs were causing hundreds to

Re: [PATCH ALT4 V2 2/2] audit: filter PATH records keyed on filesystem magic

2017-06-28 Thread Richard Guy Briggs
On 2017-06-28 15:08, Paul Moore wrote: > On Tue, Jun 27, 2017 at 4:45 PM, Richard Guy Briggs wrote: > > On 2017-05-30 17:30, Paul Moore wrote: > >> On Tue, Apr 4, 2017 at 5:21 AM, Richard Guy Briggs wrote: > >> > Tracefs or debugfs were causing hundreds to thousands of PATH records to > >> > be

Re: [PATCH ALT4 V2 2/2] audit: filter PATH records keyed on filesystem magic

2017-06-28 Thread Paul Moore
On Tue, Jun 27, 2017 at 4:45 PM, Richard Guy Briggs wrote: > On 2017-05-30 17:30, Paul Moore wrote: >> On Tue, Apr 4, 2017 at 5:21 AM, Richard Guy Briggs wrote: >> > Tracefs or debugfs were causing hundreds to thousands of PATH records to >> > be associated with

Re: [PATCH ALT4 V2 2/2] audit: filter PATH records keyed on filesystem magic

2017-06-28 Thread Paul Moore
On Tue, Jun 27, 2017 at 4:45 PM, Richard Guy Briggs wrote: > On 2017-05-30 17:30, Paul Moore wrote: >> On Tue, Apr 4, 2017 at 5:21 AM, Richard Guy Briggs wrote: >> > Tracefs or debugfs were causing hundreds to thousands of PATH records to >> > be associated with the init_module and finit_module

Re: [PATCH ALT4 V2 2/2] audit: filter PATH records keyed on filesystem magic

2017-06-27 Thread Richard Guy Briggs
On 2017-05-30 17:30, Paul Moore wrote: > On Tue, Apr 4, 2017 at 5:21 AM, Richard Guy Briggs wrote: > > Tracefs or debugfs were causing hundreds to thousands of PATH records to > > be associated with the init_module and finit_module SYSCALL records on a > > few modules when the

Re: [PATCH ALT4 V2 2/2] audit: filter PATH records keyed on filesystem magic

2017-06-27 Thread Richard Guy Briggs
On 2017-05-30 17:30, Paul Moore wrote: > On Tue, Apr 4, 2017 at 5:21 AM, Richard Guy Briggs wrote: > > Tracefs or debugfs were causing hundreds to thousands of PATH records to > > be associated with the init_module and finit_module SYSCALL records on a > > few modules when the following rule was

Re: [PATCH ALT4 V2 2/2] audit: filter PATH records keyed on filesystem magic

2017-05-30 Thread Paul Moore
On Tue, Apr 4, 2017 at 5:21 AM, Richard Guy Briggs wrote: > Tracefs or debugfs were causing hundreds to thousands of PATH records to > be associated with the init_module and finit_module SYSCALL records on a > few modules when the following rule was in place for startup: >

Re: [PATCH ALT4 V2 2/2] audit: filter PATH records keyed on filesystem magic

2017-05-30 Thread Paul Moore
On Tue, Apr 4, 2017 at 5:21 AM, Richard Guy Briggs wrote: > Tracefs or debugfs were causing hundreds to thousands of PATH records to > be associated with the init_module and finit_module SYSCALL records on a > few modules when the following rule was in place for startup: > -a always,exit

Re: [PATCH ALT4 V2 2/2] audit: filter PATH records keyed on filesystem magic

2017-04-04 Thread Richard Guy Briggs
On 2017-04-04 05:21, Richard Guy Briggs wrote: > Tracefs or debugfs were causing hundreds to thousands of PATH records to > be associated with the init_module and finit_module SYSCALL records on a > few modules when the following rule was in place for startup: > -a always,exit -F arch=x86_64

Re: [PATCH ALT4 V2 2/2] audit: filter PATH records keyed on filesystem magic

2017-04-04 Thread Richard Guy Briggs
On 2017-04-04 05:21, Richard Guy Briggs wrote: > Tracefs or debugfs were causing hundreds to thousands of PATH records to > be associated with the init_module and finit_module SYSCALL records on a > few modules when the following rule was in place for startup: > -a always,exit -F arch=x86_64

[PATCH ALT4 V2 2/2] audit: filter PATH records keyed on filesystem magic

2017-04-04 Thread Richard Guy Briggs
Tracefs or debugfs were causing hundreds to thousands of PATH records to be associated with the init_module and finit_module SYSCALL records on a few modules when the following rule was in place for startup: -a always,exit -F arch=x86_64 -S init_module -F key=mod-load Provide a method to

[PATCH ALT4 V2 2/2] audit: filter PATH records keyed on filesystem magic

2017-04-04 Thread Richard Guy Briggs
Tracefs or debugfs were causing hundreds to thousands of PATH records to be associated with the init_module and finit_module SYSCALL records on a few modules when the following rule was in place for startup: -a always,exit -F arch=x86_64 -S init_module -F key=mod-load Provide a method to