On Tue, Sep 12, 2006 at 12:07:13PM -0400, John D. Ramsdell wrote: > The polgen tools suggest SELinux policy by analyzing dynamic traces of > a running set of related programs. It derives information flow by > tracking file descriptors used by a set of programs, and notes which > processes performs reads and writes. We would very much like to get > our raw data from autrace, however, the current traces it generates > lacks some crucial information. The record for the pipe and > socketpair system call does not include the file descriptors created > upon success. Enclosed is a patch by Mark Workman that remedies this > problem.
NAK a) __NR_socketpair is not universally present b) neither __NR_socketpair nor __NR_pipe are guaranteed to be the same for 32bit and 64bit syscalls. c) just how do you propose to do "tracking file descriptors"? It's so trivial to confuse that it's not even funny; pass an SCM_RIGHTS datagram to yourself and watch that code blow chunks. Moreover, several threads can very legitimately share descriptor table and work with it in parallel. Have fun figuring out the sequence of those events... IOW, it's broken by design. -- Linux-audit mailing list Linux-audit@redhat.com https://www.redhat.com/mailman/listinfo/linux-audit
