Re: [RFC PATCH] audit: normalize NETFILTER_PKT

2017-02-08 Thread Richard Guy Briggs
On 2017-02-08 18:11, Paul Moore wrote: > On Wed, Feb 8, 2017 at 7:32 AM, Richard Guy Briggs wrote: > > On 2017-02-07 23:02, Paul Moore wrote: > >> On Tue, Feb 7, 2017 at 4:22 PM, Richard Guy Briggs wrote: > >> > On 2017-02-06 14:41, Paul Moore wrote: > >> >> On

Re: [RFC PATCH] audit: normalize NETFILTER_PKT

2017-02-08 Thread Paul Moore
On Wed, Feb 8, 2017 at 7:32 AM, Richard Guy Briggs wrote: > On 2017-02-07 23:02, Paul Moore wrote: >> On Tue, Feb 7, 2017 at 4:22 PM, Richard Guy Briggs wrote: >> > On 2017-02-06 14:41, Paul Moore wrote: >> >> On Sat, Feb 4, 2017 at 8:25 AM, Steve Grubb

Re: [RFC PATCH] audit: normalize NETFILTER_PKT

2017-02-07 Thread Richard Guy Briggs
On 2017-02-06 14:41, Paul Moore wrote: > On Sat, Feb 4, 2017 at 8:25 AM, Steve Grubb wrote: > > On Friday, February 3, 2017 6:44:16 PM EST Paul Moore wrote: > >> I'm still trying to understand what purpose this record actually > >> serves, and what requirements may exist. In

Re: [RFC PATCH] audit: normalize NETFILTER_PKT

2017-02-06 Thread Paul Moore
On Sat, Feb 4, 2017 at 8:25 AM, Steve Grubb wrote: > On Friday, February 3, 2017 6:44:16 PM EST Paul Moore wrote: >> I'm still trying to understand what purpose this record actually >> serves, and what requirements may exist. In an earlier thread >> somewhere Steve mentioned

Re: [RFC PATCH] audit: normalize NETFILTER_PKT

2017-02-03 Thread Paul Moore
On Tue, Jan 31, 2017 at 2:44 PM, Richard Guy Briggs wrote: > On 2017-01-31 17:13, Steve Grubb wrote: ... >> I was curious about something. Auparse is trying to interpret the >> icmptype field for every event. This is not good. Which fields are >> valid for each kind of packet?

Re: [RFC PATCH] audit: normalize NETFILTER_PKT

2017-01-31 Thread Steve Grubb
On Tue, 31 Jan 2017 07:57:23 -0500 Richard Guy Briggs wrote: > On 2017-01-30 10:13, Richard Guy Briggs wrote: > > On 2017-01-30 15:53, Steve Grubb wrote: > > > On Fri, 27 Jan 2017 08:11:06 -0500 > > > Richard Guy Briggs wrote: > > > > Eliminate flipping in

Re: [RFC PATCH] audit: normalize NETFILTER_PKT

2017-01-30 Thread Richard Guy Briggs
On 2017-01-30 15:53, Steve Grubb wrote: > On Fri, 27 Jan 2017 08:11:06 -0500 > Richard Guy Briggs wrote: > > Eliminate flipping in and out of message fields. > > > > https://github.com/linux-audit/audit-kernel/issues/11 > > Do you have sample events that shows how this changes

Re: [RFC PATCH] audit: normalize NETFILTER_PKT

2017-01-30 Thread Steve Grubb
On Fri, 27 Jan 2017 08:11:06 -0500 Richard Guy Briggs wrote: > Eliminate flipping in and out of message fields. > > https://github.com/linux-audit/audit-kernel/issues/11 Do you have sample events that shows how this changes the record format? I like to review how the event

[RFC PATCH] audit: normalize NETFILTER_PKT

2017-01-27 Thread Richard Guy Briggs
Eliminate flipping in and out of message fields. https://github.com/linux-audit/audit-kernel/issues/11 Signed-off-by: Richard Guy Briggs --- net/netfilter/xt_AUDIT.c | 92 +- 1 files changed, 66 insertions(+), 26 deletions(-) diff