Skip to contentSkip to conversation

minor update to rule add/delete messages (ver 2)

PATCH In review Steve Grubb 2 participants 3 messages Dec 14, 2006 – Dec 15, 2006 Audit

lore
Share & tools
lore

Steve Grubb

author
#0 lore raw

PATCH 1/1 minor update to rule add/delete messages (ver 2)

Hi,

I was looking at parsing some of these messages and found that I wanted what it was doing next to an op= for the parser to key on. Also missing was the list number and results.

Signed-off-by Steve Grubb <[email protected]>
kernel/auditfilter.c +5 -4
diff -urp linux-2.6.18.x86_64.orig/kernel/auditfilter.c linux-2.6.18.x86_64/kernel/auditfilter.c
@@ -938,9 +938,10 @@ static void audit_update_watch(struct au
 		}
 
 		ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE);
-		audit_log_format(ab, "audit updated rules specifying path=");
+		audit_log_format(ab, "op=updated rules specifying path=");
 		audit_log_untrustedstring(ab, owatch->path);
 		audit_log_format(ab, " with dev=%u ino=%lu\n", dev, ino);
+		audit_log_format(ab, " list=%d res=1", r->listnr);
 		audit_log_end(ab);
 
 		audit_remove_watch(owatch);

@@ -970,14 +971,14 @@ static void audit_remove_parent_watches(
 			e = container_of(r, struct audit_entry, rule);
 
 			ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE);
-			audit_log_format(ab, "audit implicitly removed rule path=");
+			audit_log_format(ab, "op=remove rule path=");
 			audit_log_untrustedstring(ab, w->path);
 			if (r->filterkey) {
 				audit_log_format(ab, " key=");
 				audit_log_untrustedstring(ab, r->filterkey);
 			} else
 				audit_log_format(ab, " key=(null)");
-			audit_log_format(ab, " list=%d", r->listnr);
+			audit_log_format(ab, " list=%d res=1", r->listnr);
 			audit_log_end(ab);
 
 			list_del(&r->rlist);

@@ -1411,7 +1412,7 @@ static void audit_log_rule_change(uid_t 
 			audit_log_format(ab, " subj=%s", ctx);
 		kfree(ctx);
 	}
-	audit_log_format(ab, " %s rule key=", action);
+	audit_log_format(ab, " op=%s rule key=", action);
 	if (rule->filterkey)
 		audit_log_untrustedstring(ab, rule->filterkey);
 	else
maintainer
#1 lore raw
Quoted 7 lines · Steve Grubb

Hi,

I was looking at parsing some of these messages and found that I wanted what it was doing next to an op= for the parser to key on. Also missing was the list number and results.

Signed-off-by Steve Grubb <[email protected]>

Would you mind explaining why we had to drop the chuck from the original patch to auditfilter.c which had:

if (r->filterkey) {
     audit_log_format(ab, " key=");
     audit_log_untrustedstring(ab, r->filterkey);
} else
     audit_log_format(ab, " key=(null)");

Also, can someone whack me with a clue bat? Do we have a process for getting audit patches into mainline kernel? Do they still go through viro's tree? Should it go right to akpm?

-Eric

Quoted 47 lines

diff -urp linux-2.6.18.x86_64.orig/kernel/auditfilter.c linux-2.6.18.x86_64/kernel/auditfilter.c

kernel/auditfilter.c +5 -5
@@ -938,9 +938,10 @@ static void audit_update_watch(struct au
 		}
 
 		ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE);
-		audit_log_format(ab, "audit updated rules specifying path=");
+		audit_log_format(ab, "op=updated rules specifying path=");
 		audit_log_untrustedstring(ab, owatch->path);
 		audit_log_format(ab, " with dev=%u ino=%lu\n", dev, ino);
+		audit_log_format(ab, " list=%d res=1", r->listnr);
 		audit_log_end(ab);
 
 		audit_remove_watch(owatch);

@@ -970,14 +971,14 @@ static void audit_remove_parent_watches(
 			e = container_of(r, struct audit_entry, rule);
 
 			ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE);
-			audit_log_format(ab, "audit implicitly removed rule path=");
+			audit_log_format(ab, "op=remove rule path=");
 			audit_log_untrustedstring(ab, w->path);
 			if (r->filterkey) {
 				audit_log_format(ab, " key=");
 				audit_log_untrustedstring(ab, r->filterkey);
 			} else
 				audit_log_format(ab, " key=(null)");
-			audit_log_format(ab, " list=%d", r->listnr);
+			audit_log_format(ab, " list=%d res=1", r->listnr);
 			audit_log_end(ab);
 
 			list_del(&r->rlist);

@@ -1411,7 +1412,7 @@ static void audit_log_rule_change(uid_t 
 			audit_log_format(ab, " subj=%s", ctx);
 		kfree(ctx);
 	}
-	audit_log_format(ab, " %s rule key=", action);
+	audit_log_format(ab, " op=%s rule key=", action);
 	if (rule->filterkey)
 		audit_log_untrustedstring(ab, rule->filterkey);
 	else
 
--

Linux-audit mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/linux-audit

author
#2 lore raw
Quoted 2 lines · Eric Paris

Would you mind explaining why we had to drop the chuck from the original patch to auditfilter.c which had:

After looking at the message, it is a summary message rather than individual messages for each change. So, to add the key field which may be different for each rule that contains that path would involve a larger re-write so. I wasn't sure that its worth it.

-Steve