Re: [PATCH V5 0/5] audit by executable name

2014-10-29 Thread Richard Guy Briggs
On 14/10/29, Eric Paris wrote: > On Wed, 2014-10-29 at 17:54 -0400, Richard Guy Briggs wrote: > > On 14/10/29, Steve Grubb wrote: > > > On Wednesday, October 29, 2014 03:48:40 PM Richard Guy Briggs wrote: > > > > On 14/10/21, Paul Moore wrote: > > > > > > > Can anyone think of anything else that mi

Re: [PATCH V5 0/5] audit by executable name

2014-10-29 Thread Eric Paris
On Wed, 2014-10-29 at 17:54 -0400, Richard Guy Briggs wrote: > On 14/10/29, Steve Grubb wrote: > > On Wednesday, October 29, 2014 03:48:40 PM Richard Guy Briggs wrote: > > > On 14/10/21, Paul Moore wrote: > > > > > > Can anyone think of anything else that might be affected by this? > > > > > > > >

Re: [PATCH V5 0/5] audit by executable name

2014-10-29 Thread Richard Guy Briggs
On 14/10/29, Steve Grubb wrote: > On Wednesday, October 29, 2014 03:48:40 PM Richard Guy Briggs wrote: > > On 14/10/21, Paul Moore wrote: > > > > > Can anyone think of anything else that might be affected by this? > > > > > > > > No one uses this stuff, just change it. > > > > > > Yes, but I feel

Re: [RFC][PATCH] audit: log join and part events to the read-only multicast log socket

2014-10-29 Thread Richard Guy Briggs
On 14/10/22, Steve Grubb wrote: > On Tuesday, October 21, 2014 06:30:24 PM Paul Moore wrote: > > On Tuesday, October 21, 2014 03:56:10 PM Steve Grubb wrote: > > Before we go to much farther, I'd really like us to agree that ordering is > > not important, can we do that? > > Its kind of doubtful w

Re: [RFC][PATCH] audit: log join and part events to the read-only multicast log socket

2014-10-29 Thread Richard Guy Briggs
On 14/10/22, Paul Moore wrote: > On Tuesday, October 21, 2014 09:24:05 PM Richard Guy Briggs wrote: > > On 14/10/21, Paul Moore wrote: > > > Before we go to much farther, I'd really like us to agree that ordering is > > > not important, can we do that? As a follow up, what do we need to do to > >

Re: [RFC][PATCH] audit: log join and part events to the read-only multicast log socket

2014-10-29 Thread Richard Guy Briggs
On 14/10/21, Steve Grubb wrote: > On Tuesday, October 21, 2014 05:08:22 PM Richard Guy Briggs wrote: > > On 14/10/21, Steve Grubb wrote: > > > > super crazy yuck. audit_log_task_info() ?? > > > > > > Its a shame we don't have a audit_log_task_info_light function which only > > > records: > > > >

Re: [PATCH V5 0/5] audit by executable name

2014-10-29 Thread Steve Grubb
On Wednesday, October 29, 2014 03:48:40 PM Richard Guy Briggs wrote: > On 14/10/21, Paul Moore wrote: > > > > Can anyone think of anything else that might be affected by this? > > > > > > No one uses this stuff, just change it. > > > > Yes, but I feel like I need to at least ask the question; how

Re: [PATCH V5 0/5] audit by executable name

2014-10-29 Thread Richard Guy Briggs
On 14/10/21, Paul Moore wrote: > On Tuesday, October 21, 2014 06:19:52 PM Eric Paris wrote: > > On Tue, 2014-10-21 at 17:56 -0400, Paul Moore wrote: > > > * Change the audit_status.version field comment in > > > include/uapi/linux/audit.h to "/* audit functionality bitmap */", or > > > similar. We

Re: auditd at a 32 bit Gentoo Linux x86 system won't work any longer with 3.18-rc2

2014-10-29 Thread Toralf Förster
On 10/29/2014 07:36 PM, Paul Moore wrote: > On Wed, Oct 29, 2014 at 1:42 PM, Toralf Förster > wrote: >> Versin 2.2.2 is fine with kernel 3.17, but with c3.18-rc2 I do have an issue. >> >> As soon as auditd is started, I do get within the KVM an >> "INIT: Id "c1! respawning too fast: disabled for

Re: [PATCH][STABLE] audit: correct AUDIT_GET_FEATURE return message type

2014-10-29 Thread Richard Guy Briggs
On 14/10/29, Richard Guy Briggs wrote: > On 14/10/29, Greg KH wrote: > > On Wed, Oct 29, 2014 at 09:35:06AM -0400, Richard Guy Briggs wrote: > > > When an AUDIT_GET_FEATURE message is sent from userspace to the kernel, it > > > should reply with a message tagged as an AUDIT_GET_FEATURE type with a

Re: auditd at a 32 bit Gentoo Linux x86 system won't work any longer with 3.18-rc2

2014-10-29 Thread Paul Moore
On Wed, Oct 29, 2014 at 1:42 PM, Toralf Förster wrote: > Versin 2.2.2 is fine with kernel 3.17, but with c3.18-rc2 I do have an issue. > > As soon as auditd is started, I do get within the KVM an > "INIT: Id "c1! respawning too fast: disabled for 5 minutes" when I try to > login into the KVM as r

auditd at a 32 bit Gentoo Linux x86 system won't work any longer with 3.18-rc2

2014-10-29 Thread Toralf Förster
Versin 2.2.2 is fine with kernel 3.17, but with c3.18-rc2 I do have an issue. As soon as auditd is started, I do get within the KVM an "INIT: Id "c1! respawning too fast: disabled for 5 minutes" when I try to login into the KVM as root. Furthermore as an previously logged in user I can run any c

Re: [PATCH][STABLE] audit: correct AUDIT_GET_FEATURE return message type

2014-10-29 Thread Richard Guy Briggs
On 14/10/29, Greg KH wrote: > On Wed, Oct 29, 2014 at 09:35:06AM -0400, Richard Guy Briggs wrote: > > When an AUDIT_GET_FEATURE message is sent from userspace to the kernel, it > > should reply with a message tagged as an AUDIT_GET_FEATURE type with a > > struct > > audit_feature. The current rep

Re: [PATCH][STABLE] audit: correct AUDIT_GET_FEATURE return message type

2014-10-29 Thread Greg KH
On Wed, Oct 29, 2014 at 09:35:06AM -0400, Richard Guy Briggs wrote: > When an AUDIT_GET_FEATURE message is sent from userspace to the kernel, it > should reply with a message tagged as an AUDIT_GET_FEATURE type with a struct > audit_feature. The current reply is a message tagged as an AUDIT_GET >

Re: [PATCH][STABLE] audit: correct AUDIT_GET_FEATURE return message type

2014-10-29 Thread Paul Moore
On Wednesday, October 29, 2014 09:35:06 AM Richard Guy Briggs wrote: > When an AUDIT_GET_FEATURE message is sent from userspace to the kernel, it > should reply with a message tagged as an AUDIT_GET_FEATURE type with a > struct audit_feature. The current reply is a message tagged as an > AUDIT_GET

[PATCH][STABLE] audit: correct AUDIT_GET_FEATURE return message type

2014-10-29 Thread Richard Guy Briggs
When an AUDIT_GET_FEATURE message is sent from userspace to the kernel, it should reply with a message tagged as an AUDIT_GET_FEATURE type with a struct audit_feature. The current reply is a message tagged as an AUDIT_GET type with a struct audit_feature. This appears to have been a cut-and-paste