Re: [PATCH ghak120 V5] audit: trigger accompanying records when no rules present

2020-10-28 Thread Paul Moore
On Wed, Sep 23, 2020 at 1:47 PM Paul Moore wrote: > On Wed, Sep 23, 2020 at 10:49 AM Richard Guy Briggs wrote: > > On 2020-09-23 10:29, Paul Moore wrote: > > > I've gone over this revision a couple of times now and it looks okay, > > > but past experience is whispering in my ear that perhaps this

Re: [PATCH ghak120 V5] audit: trigger accompanying records when no rules present

2020-09-23 Thread Paul Moore
On Wed, Sep 23, 2020 at 10:49 AM Richard Guy Briggs wrote: > On 2020-09-23 10:29, Paul Moore wrote: > > I've gone over this revision a couple of times now and it looks okay, > > but past experience is whispering in my ear that perhaps this is > > better to wait on this for the next cycle so it get

Re: [PATCH ghak120 V5] audit: trigger accompanying records when no rules present

2020-09-23 Thread Richard Guy Briggs
On 2020-09-23 10:29, Paul Moore wrote: > On Tue, Sep 22, 2020 at 8:45 AM Richard Guy Briggs wrote: > > > > When there are no audit rules registered, mandatory records (config, > > etc.) are missing their accompanying records (syscall, proctitle, etc.). > > > > This is due to audit context dummy se

Re: [PATCH ghak120 V5] audit: trigger accompanying records when no rules present

2020-09-23 Thread Paul Moore
On Tue, Sep 22, 2020 at 8:45 AM Richard Guy Briggs wrote: > > When there are no audit rules registered, mandatory records (config, > etc.) are missing their accompanying records (syscall, proctitle, etc.). > > This is due to audit context dummy set on syscall entry based on absence > of rules that

[PATCH ghak120 V5] audit: trigger accompanying records when no rules present

2020-09-22 Thread Richard Guy Briggs
When there are no audit rules registered, mandatory records (config, etc.) are missing their accompanying records (syscall, proctitle, etc.). This is due to audit context dummy set on syscall entry based on absence of rules that signals that no other records are to be printed. Clear the dummy bit