Re: [PATCH ghak109 V2] audit: link integrity evm_write_xattrs record to syscall event

2019-03-27 Thread Paul Moore
On Wed, Mar 27, 2019 at 11:05 AM Mimi Zohar wrote: > On Tue, 2019-03-26 at 19:58 -0400, Paul Moore wrote: > > On Tue, Mar 26, 2019 at 4:40 PM Mimi Zohar wrote: > > > > > > Hi Richard, Paul, > > > > > > On Tue, 2019-03-26 at 14:49 -0400, Richard Guy Briggs wrote: > > > > In commit fa516b66a1bf

Re: [PATCH ghak109 V2] audit: link integrity evm_write_xattrs record to syscall event

2019-03-27 Thread Mimi Zohar
On Tue, 2019-03-26 at 19:58 -0400, Paul Moore wrote: > On Tue, Mar 26, 2019 at 4:40 PM Mimi Zohar wrote: > > > > Hi Richard, Paul, > > > > On Tue, 2019-03-26 at 14:49 -0400, Richard Guy Briggs wrote: > > > In commit fa516b66a1bf ("EVM: Allow runtime modification of the set of > > > verified

Re: [PATCH ghak109 V2] audit: link integrity evm_write_xattrs record to syscall event

2019-03-26 Thread Paul Moore
On Tue, Mar 26, 2019 at 4:40 PM Mimi Zohar wrote: > > Hi Richard, Paul, > > On Tue, 2019-03-26 at 14:49 -0400, Richard Guy Briggs wrote: > > In commit fa516b66a1bf ("EVM: Allow runtime modification of the set of > > verified xattrs"), the call to audit_log_start() is missing a context to > > link

Re: [PATCH ghak109 V2] audit: link integrity evm_write_xattrs record to syscall event

2019-03-26 Thread Mimi Zohar
Hi Richard, Paul, On Tue, 2019-03-26 at 14:49 -0400, Richard Guy Briggs wrote: > In commit fa516b66a1bf ("EVM: Allow runtime modification of the set of > verified xattrs"), the call to audit_log_start() is missing a context to > link it to an audit event. Since this event is in user context, add

[PATCH ghak109 V2] audit: link integrity evm_write_xattrs record to syscall event

2019-03-26 Thread Richard Guy Briggs
In commit fa516b66a1bf ("EVM: Allow runtime modification of the set of verified xattrs"), the call to audit_log_start() is missing a context to link it to an audit event. Since this event is in user context, add the process' syscall context to the record. In addition, the orphaned keyword