Re: [systemd-devel] [PATCH] core: check system call auditing is enabled

2013-02-20 Thread Jon Stanley
On Tue, Feb 19, 2013 at 8:36 PM, Lennart Poettering wrote: > So, yeah, let's just fix the audit issue and that's it. Yep, I realized after seeing all the other responses to this mail that it was purely accidental, and I was a bit hasty in saying "oh noes, audit??" :) Move on, fix the bug, and k

Re: [systemd-devel] [PATCH] core: check system call auditing is enabled

2013-02-19 Thread Lennart Poettering
On Tue, 19.02.13 15:52, Jon Stanley (jonstan...@gmail.com) wrote: > > On Tue, Feb 19, 2013 at 3:06 PM, Kok, Auke-jan H > wrote: > > > Is this really necessary? > > I second this concern, for entirely different reasons. In certain > applications, low latency in the kernel is paramount to all el

Re: [systemd-devel] [PATCH] core: check system call auditing is enabled

2013-02-19 Thread Jon Masters
On 02/19/2013 03:49 PM, Lennart Poettering wrote: > On Tue, 19.02.13 14:29, Jon Masters (jonat...@jonmasters.org) wrote: > >> From: Jon Masters >> >> Systemd relies upon CONFIG_AUDITSYSCALL support being present in the >> kernel. > > Actually it doesn't. There's just a bug with pkexec on systems

Re: [systemd-devel] [PATCH] core: check system call auditing is enabled

2013-02-19 Thread Jon Stanley
On Tue, Feb 19, 2013 at 3:06 PM, Kok, Auke-jan H wrote: > Is this really necessary? I second this concern, for entirely different reasons. In certain applications, low latency in the kernel is paramount to all else. Enabling CONFIG_AUDIT* would seem to fly in the face of this. I really want syst

Re: [systemd-devel] [PATCH] core: check system call auditing is enabled

2013-02-19 Thread Kay Sievers
On Tue, Feb 19, 2013 at 9:06 PM, Kok, Auke-jan H wrote: > On Tue, Feb 19, 2013 at 11:29 AM, Jon Masters wrote: >> From: Jon Masters >> >> Systemd relies upon CONFIG_AUDITSYSCALL support being present in the kernel. >> This is because systemd-logind calls audit_session_from_pid, which uses >> /pr

Re: [systemd-devel] [PATCH] core: check system call auditing is enabled

2013-02-19 Thread Lennart Poettering
On Tue, 19.02.13 14:29, Jon Masters (jonat...@jonmasters.org) wrote: > From: Jon Masters > > Systemd relies upon CONFIG_AUDITSYSCALL support being present in the > kernel. Actually it doesn't. There's just a bug with pkexec on systems that lack auditing, but we really should fix that. We defini

Re: [systemd-devel] [PATCH] core: check system call auditing is enabled

2013-02-19 Thread Jon Masters
Hi Auke, A warning is necessary to prevent silent breakage of the kind I tracked down in Fedora ARM. However, the warning could be in the session code (there is only silent failure currently). I can look at that if folks prefer. Separately, I think there should be a set of test_kconfig tests ca

Re: [systemd-devel] [PATCH] core: check system call auditing is enabled

2013-02-19 Thread Kok, Auke-jan H
On Tue, Feb 19, 2013 at 11:29 AM, Jon Masters wrote: > From: Jon Masters > > Systemd relies upon CONFIG_AUDITSYSCALL support being present in the kernel. > This is because systemd-logind calls audit_session_from_pid, which uses > /proc/self/sessionid to determine whether an existing session is be

[systemd-devel] [PATCH] core: check system call auditing is enabled

2013-02-19 Thread Jon Masters
From: Jon Masters Systemd relies upon CONFIG_AUDITSYSCALL support being present in the kernel. This is because systemd-logind calls audit_session_from_pid, which uses /proc/self/sessionid to determine whether an existing session is being replaced as part of e.g. a call to sudo, pkexec, or similar