Re: [PATCH ghak109 V1] audit: link integrity evm_write_xattrs record to syscall event

2019-03-26 Thread Matthew Garrett
On Tue, Mar 26, 2019 at 10:43 AM Richard Guy Briggs wrote: > Ok, what I typed above wasn't quite what I intended... This is what I > meant: > > audit_log_format(ab, "xattr="); > audit_log_untrustedstring(ab, "."); > > But, I'll just move the normal case above the "." locking

Re: [PATCH ghak109 V1] audit: link integrity evm_write_xattrs record to syscall event

2019-03-26 Thread Richard Guy Briggs
On 2019-03-26 12:14, Richard Guy Briggs wrote: > On 2019-03-26 11:29, Mimi Zohar wrote: > > On Tue, 2019-03-26 at 11:22 -0400, Steve Grubb wrote: > > > > > > > > --- a/security/integrity/evm/evm_secfs.c > > > > > > +++ b/security/integrity/evm/evm_secfs.c > > > > > > @@ -192,7 +192,8 @@ static

Re: [PATCH ghak109 V1] audit: link integrity evm_write_xattrs record to syscall event

2019-03-26 Thread Richard Guy Briggs
On 2019-03-26 11:29, Mimi Zohar wrote: > On Tue, 2019-03-26 at 11:22 -0400, Steve Grubb wrote: > > > > > > --- a/security/integrity/evm/evm_secfs.c > > > > > +++ b/security/integrity/evm/evm_secfs.c > > > > > @@ -192,7 +192,8 @@ static ssize_t evm_write_xattrs(struct file *file, > > > > > const

Re: [PATCH ghak109 V1] audit: link integrity evm_write_xattrs record to syscall event

2019-03-26 Thread Mimi Zohar
On Tue, 2019-03-26 at 11:22 -0400, Steve Grubb wrote: > > > > --- a/security/integrity/evm/evm_secfs.c > > > > +++ b/security/integrity/evm/evm_secfs.c > > > > @@ -192,7 +192,8 @@ static ssize_t evm_write_xattrs(struct file *file, > > > > const char __user *buf,> > > > > > if (count >

Re: [PATCH ghak109 V1] audit: link integrity evm_write_xattrs record to syscall event

2019-03-26 Thread Steve Grubb
On Wednesday, March 20, 2019 8:50:08 PM EDT Richard Guy Briggs wrote: > On 2019-03-20 19:48, Paul Moore wrote: > > On Sat, Mar 16, 2019 at 8:10 AM Richard Guy Briggs wrote: > > > In commit fa516b66a1bf ("EVM: Allow runtime modification of the set of > > > verified xattrs"), the call to

Re: [PATCH ghak109 V1] audit: link integrity evm_write_xattrs record to syscall event

2019-03-26 Thread Mimi Zohar
On Wed, 2019-03-20 at 20:50 -0400, Richard Guy Briggs wrote: > On 2019-03-20 19:48, Paul Moore wrote: > > On Sat, Mar 16, 2019 at 8:10 AM Richard Guy Briggs wrote: > > > In commit fa516b66a1bf ("EVM: Allow runtime modification of the set of > > > verified xattrs"), the call to audit_log_start()

Re: [PATCH ghak109 V1] audit: link integrity evm_write_xattrs record to syscall event

2019-03-20 Thread Paul Moore
On Wed, Mar 20, 2019 at 8:50 PM Richard Guy Briggs wrote: > On 2019-03-20 19:48, Paul Moore wrote: > > On Sat, Mar 16, 2019 at 8:10 AM Richard Guy Briggs wrote: > > > In commit fa516b66a1bf ("EVM: Allow runtime modification of the set of > > > verified xattrs"), the call to audit_log_start() is

Re: [PATCH ghak109 V1] audit: link integrity evm_write_xattrs record to syscall event

2019-03-20 Thread Richard Guy Briggs
On 2019-03-20 19:48, Paul Moore wrote: > On Sat, Mar 16, 2019 at 8:10 AM Richard Guy Briggs wrote: > > In commit fa516b66a1bf ("EVM: Allow runtime modification of the set of > > verified xattrs"), the call to audit_log_start() is missing a context to > > link it to an audit event. Since this

Re: [PATCH ghak109 V1] audit: link integrity evm_write_xattrs record to syscall event

2019-03-20 Thread Paul Moore
On Sat, Mar 16, 2019 at 8:10 AM Richard Guy Briggs wrote: > In commit fa516b66a1bf ("EVM: Allow runtime modification of the set of > verified xattrs"), the call to audit_log_start() is missing a context to > link it to an audit event. Since this event is in user context, add > the process'

[PATCH ghak109 V1] audit: link integrity evm_write_xattrs record to syscall event

2019-03-16 Thread Richard Guy Briggs
In commit fa516b66a1bf ("EVM: Allow runtime modification of the set of verified xattrs"), the call to audit_log_start() is missing a context to link it to an audit event. Since this event is in user context, add the process' syscall context to the record. In addition, the orphaned keyword