Re: [PATCH] audit: optionally print warning after waiting to enqueue record

2020-06-18 Thread Richard Guy Briggs
On 2020-06-18 23:48, Max Englander wrote: > On Wed, Jun 17, 2020 at 09:06:27PM -0400, Paul Moore wrote: > > On Wed, Jun 17, 2020 at 6:54 PM Max Englander > > wrote: > > > On Wed, Jun 17, 2020 at 02:47:19PM -0400, Paul Moore wrote: > > > > On Tue, Jun 16, 2020 at 12:58 AM Max Englander > > > >

Re: Error handling of auditctl -w

2020-06-18 Thread Lenny Bruzenak
On 6/16/20 2:00 PM, Stefan Tauner wrote: Hi, I was wondering why my auditctl executions do not print any errors but apparently didn't do anything. After checking the return value (which was 255) I looked at the code and noticed that audit_setup_perms() and audit_update_watch_perms() have

Re: [PATCH] audit: optionally print warning after waiting to enqueue record

2020-06-18 Thread Max Englander
On Wed, Jun 17, 2020 at 09:06:27PM -0400, Paul Moore wrote: > On Wed, Jun 17, 2020 at 6:54 PM Max Englander wrote: > > On Wed, Jun 17, 2020 at 02:47:19PM -0400, Paul Moore wrote: > > > On Tue, Jun 16, 2020 at 12:58 AM Max Englander > > > wrote: > > > > > > > > In environments where security is

Re: [PATCH] audit: optionally print warning after waiting to enqueue record

2020-06-18 Thread Max Englander
On Thu, Jun 18, 2020 at 09:39:08AM -0400, Steve Grubb wrote: > On Wednesday, June 17, 2020 6:54:16 PM EDT Max Englander wrote: > > On Wed, Jun 17, 2020 at 02:47:19PM -0400, Paul Moore wrote: > > > On Tue, Jun 16, 2020 at 12:58 AM Max Englander > wrote: > > > > In environments where security is

Re: [PATCH 2/2] integrity: Add errno field in audit message

2020-06-18 Thread Mimi Zohar
On Wed, 2020-06-17 at 13:44 -0700, Lakshmi Ramasubramanian wrote: > Error code is not included in the audit messages logged by > the integrity subsystem. Add "errno" field in the audit messages > logged by the integrity subsystem and set the value to the error code > passed to

Re: [PATCH 2/2] integrity: Add errno field in audit message

2020-06-18 Thread Mimi Zohar
On Thu, 2020-06-18 at 11:05 -0700, Lakshmi Ramasubramanian wrote: > On 6/18/20 10:41 AM, Mimi Zohar wrote: > > > > > For the reasons that I mentioned previously, unless others are willing > > to add their Reviewed-by tag not for the audit aspect in particular, > > but IMA itself, I'm not

Re: [PATCH 2/2] integrity: Add errno field in audit message

2020-06-18 Thread Lakshmi Ramasubramanian
On 6/18/20 10:41 AM, Mimi Zohar wrote: For the reasons that I mentioned previously, unless others are willing to add their Reviewed-by tag not for the audit aspect in particular, but IMA itself, I'm not comfortable making this change all at once. Previously I suggested making the existing

Re: [PATCH] audit: optionally print warning after waiting to enqueue record

2020-06-18 Thread Paul Moore
On Thu, Jun 18, 2020 at 10:36 AM Steve Grubb wrote: > On Thursday, June 18, 2020 9:46:54 AM EDT Paul Moore wrote: > > On Thu, Jun 18, 2020 at 9:39 AM Steve Grubb wrote: > > > The kernel cannot grow the backlog unbounded. If you do nothing, the > > > backlog is 64 - which is too small to really

Re: [PATCH] audit: optionally print warning after waiting to enqueue record

2020-06-18 Thread Steve Grubb
On Thursday, June 18, 2020 9:46:54 AM EDT Paul Moore wrote: > On Thu, Jun 18, 2020 at 9:39 AM Steve Grubb wrote: > > The kernel cannot grow the backlog unbounded. If you do nothing, the > > backlog is 64 - which is too small to really use. Otherwise, you set the > > backlog to a finite number

Re: [PATCH] audit: optionally print warning after waiting to enqueue record

2020-06-18 Thread Paul Moore
On Thu, Jun 18, 2020 at 9:39 AM Steve Grubb wrote: > The kernel cannot grow the backlog unbounded. If you do nothing, the backlog > is 64 - which is too small to really use. Otherwise, you set the backlog to a > finite number with the -b option. If one were to set the backlog limit to 0, it is

Re: [PATCH] audit: optionally print warning after waiting to enqueue record

2020-06-18 Thread Steve Grubb
On Wednesday, June 17, 2020 6:54:16 PM EDT Max Englander wrote: > On Wed, Jun 17, 2020 at 02:47:19PM -0400, Paul Moore wrote: > > On Tue, Jun 16, 2020 at 12:58 AM Max Englander wrote: > > > In environments where security is prioritized, users may set > > > --backlog_wait_time to a high value in