Re: [PATCH V6 1/4] audit: implement audit by executable

2015-07-20 Thread Paul Moore
On Friday, July 17, 2015 04:46:18 PM Richard Guy Briggs wrote: > On 15/07/17, Paul Moore wrote: > > You could do a "based on" or similar tag if you want. I'm honestly not > > sure what the official tags are beyond signed-off, acked, and reviewed. > > Those are the only ones I really care about

Re: [PATCH V6 1/4] audit: implement audit by executable

2015-07-20 Thread Paul Moore
On Friday, July 17, 2015 04:46:18 PM Richard Guy Briggs wrote: On 15/07/17, Paul Moore wrote: You could do a based on or similar tag if you want. I'm honestly not sure what the official tags are beyond signed-off, acked, and reviewed. Those are the only ones I really care about anyway ;)

Re: [PATCH V6 1/4] audit: implement audit by executable

2015-07-17 Thread Richard Guy Briggs
On 15/07/17, Paul Moore wrote: > On Friday, July 17, 2015 11:33:17 AM Richard Guy Briggs wrote: > > On 15/07/16, Paul Moore wrote: > > > On Tuesday, July 14, 2015 11:50:23 AM Richard Guy Briggs wrote: > > > > From: Eric Paris > > > > > > > > This patch implements the ability to filter on the

Re: [PATCH V6 1/4] audit: implement audit by executable

2015-07-17 Thread Richard Guy Briggs
On 15/07/17, Richard Guy Briggs wrote: > On 15/07/16, Paul Moore wrote: > > On Tuesday, July 14, 2015 11:50:23 AM Richard Guy Briggs wrote: > > > From: Eric Paris > > > > > > This patch implements the ability to filter on the executable. It is > > > clearly incomplete! This patch adds the

Re: [PATCH V6 1/4] audit: implement audit by executable

2015-07-17 Thread Paul Moore
On Friday, July 17, 2015 11:33:17 AM Richard Guy Briggs wrote: > On 15/07/16, Paul Moore wrote: > > On Tuesday, July 14, 2015 11:50:23 AM Richard Guy Briggs wrote: > > > From: Eric Paris > > > > > > This patch implements the ability to filter on the executable. It is > > > clearly incomplete!

Re: [PATCH V6 1/4] audit: implement audit by executable

2015-07-17 Thread Richard Guy Briggs
On 15/07/16, Paul Moore wrote: > On Tuesday, July 14, 2015 11:50:23 AM Richard Guy Briggs wrote: > > From: Eric Paris > > > > This patch implements the ability to filter on the executable. It is > > clearly incomplete! This patch adds the inode/dev of the executable at > > the moment the rule

Re: [PATCH V6 1/4] audit: implement audit by executable

2015-07-17 Thread Richard Guy Briggs
On 15/07/16, Paul Moore wrote: On Tuesday, July 14, 2015 11:50:23 AM Richard Guy Briggs wrote: From: Eric Paris epa...@redhat.com This patch implements the ability to filter on the executable. It is clearly incomplete! This patch adds the inode/dev of the executable at the moment the

Re: [PATCH V6 1/4] audit: implement audit by executable

2015-07-17 Thread Paul Moore
On Friday, July 17, 2015 11:33:17 AM Richard Guy Briggs wrote: On 15/07/16, Paul Moore wrote: On Tuesday, July 14, 2015 11:50:23 AM Richard Guy Briggs wrote: From: Eric Paris epa...@redhat.com This patch implements the ability to filter on the executable. It is clearly incomplete!

Re: [PATCH V6 1/4] audit: implement audit by executable

2015-07-17 Thread Richard Guy Briggs
On 15/07/17, Paul Moore wrote: On Friday, July 17, 2015 11:33:17 AM Richard Guy Briggs wrote: On 15/07/16, Paul Moore wrote: On Tuesday, July 14, 2015 11:50:23 AM Richard Guy Briggs wrote: From: Eric Paris epa...@redhat.com This patch implements the ability to filter on the

Re: [PATCH V6 1/4] audit: implement audit by executable

2015-07-17 Thread Richard Guy Briggs
On 15/07/17, Richard Guy Briggs wrote: On 15/07/16, Paul Moore wrote: On Tuesday, July 14, 2015 11:50:23 AM Richard Guy Briggs wrote: From: Eric Paris epa...@redhat.com This patch implements the ability to filter on the executable. It is clearly incomplete! This patch adds the

Re: [PATCH V6 1/4] audit: implement audit by executable

2015-07-16 Thread Paul Moore
On Tuesday, July 14, 2015 11:50:23 AM Richard Guy Briggs wrote: > From: Eric Paris > > This patch implements the ability to filter on the executable. It is > clearly incomplete! This patch adds the inode/dev of the executable at > the moment the rule is loaded. It does not update if the

Re: [PATCH V6 1/4] audit: implement audit by executable

2015-07-16 Thread Paul Moore
On Tuesday, July 14, 2015 11:50:23 AM Richard Guy Briggs wrote: From: Eric Paris epa...@redhat.com This patch implements the ability to filter on the executable. It is clearly incomplete! This patch adds the inode/dev of the executable at the moment the rule is loaded. It does not update

[PATCH V6 1/4] audit: implement audit by executable

2015-07-14 Thread Richard Guy Briggs
From: Eric Paris This patch implements the ability to filter on the executable. It is clearly incomplete! This patch adds the inode/dev of the executable at the moment the rule is loaded. It does not update if the executable is updated/moved/whatever. That should be added. But at this

[PATCH V6 1/4] audit: implement audit by executable

2015-07-14 Thread Richard Guy Briggs
From: Eric Paris epa...@redhat.com This patch implements the ability to filter on the executable. It is clearly incomplete! This patch adds the inode/dev of the executable at the moment the rule is loaded. It does not update if the executable is updated/moved/whatever. That should be added.