Add support for session ID user filtering

PATCH In review Richard Guy Briggs 3 participants 12 messages Aug 18, 2016 – Nov 20, 2016 Audit

lore

Share & tools

lore

Richard Guy Briggs

author

2016-08-18 17:43 UTC #0 lore raw

v3 cover Add support for session ID user filtering

https://github.com/linux-audit/audit-kernel/wiki/RFE-Session-ID-User-Filter
RFE Session ID User Filter

https://github.com/linux-audit/audit-kernel/issues/4
RFE: add a session ID filter to the kernel's user filter

See also the set of userspace suport patches:
Add support for sessionid user filters, sessionid_set and loginuid_set
https://www.redhat.com/archives/linux-audit/2016-August/msg00005.html
(userspace update expected to be posted 2016-08-18)
and the test case:
https://github.com/rgbriggs/audit-testsuite/tree/ghak4-test-for-sessionID-user-filter

This third patch is expected to have a merge conflict with:
"audit: add exclude filter extension to feature bitmap"
posted on 2016-08-18.

Richard Guy Briggs (3):
audit: add support for session ID user filter
audit: add AUDIT_SESSIONID_SET support
audit: add sessionid filter extension to feature bitmap

 include/linux/audit.h      |   10 ++++++++++
 include/uapi/linux/audit.h |    6 +++++-
 kernel/auditfilter.c       |    5 +++++
 kernel/auditsc.c           |    6 ++++++
 4 files changed, 26 insertions(+), 1 deletions(-)

Richard Guy Briggs

author

2016-08-18 17:43 UTC #1 lore raw

PATCH v3 1/3 audit: add support for session ID user filter

Define AUDIT_SESSIONID in the uapi and add support for specifying user filters based on the session ID.

https://github.com/linux-audit/audit-kernel/issues/4
RFE: add a session ID filter to the kernel's user filter

Signed-off-by Richard Guy Briggs <[email protected]>

---
 include/uapi/linux/audit.h |    1 +
 kernel/auditfilter.c       |    2 ++
 kernel/auditsc.c           |    5 +++++
 3 files changed, 8 insertions(+), 0 deletions(-)

include/uapi/linux/audit.h +1 -0

index d820aa9..b3140eb 100644
@@ -252,6 +252,7 @@
 #define AUDIT_OBJ_LEV_LOW	22
 #define AUDIT_OBJ_LEV_HIGH	23
 #define AUDIT_LOGINUID_SET	24
+#define AUDIT_SESSIONID	25	/* Session ID */
 
 				/* These are ONLY useful when checking
 				 * at syscall exit time (AUDIT_AT_EXIT). */

kernel/auditfilter.c +2 -0

index 85d9cac..1c60fcf 100644
@@ -363,6 +363,7 @@ static int audit_field_valid(struct audit_entry *entry, struct audit_field *f)
 	case AUDIT_EXIT:
 	case AUDIT_SUCCESS:
 	case AUDIT_INODE:
+	case AUDIT_SESSIONID:
 		/* bit ops are only useful on syscall args */
 		if (f->op == Audit_bitmask || f->op == Audit_bittest)
 			return -EINVAL;

@@ -476,6 +477,7 @@ static struct audit_entry *audit_data_to_entry(struct audit_rule_data *data,
 			if (!gid_valid(f->gid))
 				goto exit_free;
 			break;
+		case AUDIT_SESSIONID:
 		case AUDIT_ARCH:
 			entry->rule.arch_f = f;
 			break;

kernel/auditsc.c +5 -0

index c65af21..52f7a61 100644
@@ -447,6 +447,7 @@ static int audit_filter_rules(struct task_struct *tsk,
 	const struct cred *cred;
 	int i, need_sid = 1;
 	u32 sid;
+	unsigned int sessionid;
 
 	cred = rcu_dereference_check(tsk->cred, tsk == current || task_creation);

@@ -509,6 +510,10 @@ static int audit_filter_rules(struct task_struct *tsk,
 		case AUDIT_FSGID:
 			result = audit_gid_comparator(cred->fsgid, f->op, f->gid);
 			break;
+		case AUDIT_SESSIONID:
+			sessionid = audit_get_sessionid(current);
+			result = audit_comparator(sessionid, f->op, f->val);
+			break;
 		case AUDIT_PERS:
 			result = audit_comparator(tsk->personality, f->op, f->val);
 			break;

Signature · 1 line

1.7.1

Richard Guy Briggs

author

2016-08-18 17:43 UTC #2 lore raw

PATCH v3 2/3 audit: add AUDIT_SESSIONID_SET support

In reply to Richard Guy Briggs

Add AUDIT_SESSIONID_SET field to indicate the sessionID is set in filters rather than depending on an in-band signal to indicate it.

https://github.com/linux-audit/audit-kernel/wiki/RFE-Session-ID-User-Filter
RFE Session ID User Filter

https://github.com/linux-audit/audit-kernel/issues/4
RFE: add a session ID filter to the kernel's user filter

Signed-off-by Richard Guy Briggs <[email protected]>

---
 include/linux/audit.h      |   10 ++++++++++
 include/uapi/linux/audit.h |    1 +
 kernel/auditfilter.c       |    3 +++
 kernel/auditsc.c           |    7 ++++---
 4 files changed, 18 insertions(+), 3 deletions(-)

include/linux/audit.h +10 -0

index 9d4443f..2392442 100644
@@ -552,6 +552,16 @@ static inline bool audit_loginuid_set(struct task_struct *tsk)
 	return uid_valid(audit_get_loginuid(tsk));
 }
 
+static inline bool sessionid_valid(unsigned int sessionid)
+{
+	return sessionid != (unsigned int) -1;
+}
+
+static inline bool audit_sessionid_set(struct task_struct *tsk)
+{
+	return sessionid_valid(audit_get_sessionid(tsk));
+}
+
 static inline void audit_log_string(struct audit_buffer *ab, const char *buf)
 {
 	audit_log_n_string(ab, buf, strlen(buf));

include/uapi/linux/audit.h +1 -0

index b3140eb..a4048bc 100644
@@ -253,6 +253,7 @@
 #define AUDIT_OBJ_LEV_HIGH	23
 #define AUDIT_LOGINUID_SET	24
 #define AUDIT_SESSIONID	25	/* Session ID */
+#define AUDIT_SESSIONID_SET	26	/* Session ID set or not */
 
 				/* These are ONLY useful when checking
 				 * at syscall exit time (AUDIT_AT_EXIT). */

kernel/auditfilter.c +3 -0

index 1c60fcf..47eaaba 100644
@@ -387,6 +387,7 @@ static int audit_field_valid(struct audit_entry *entry, struct audit_field *f)
 	case AUDIT_FILTERKEY:
 		break;
 	case AUDIT_LOGINUID_SET:
+	case AUDIT_SESSIONID_SET:
 		if ((f->val != 0) && (f->val != 1))
 			return -EINVAL;
 	/* FALL THROUGH */

@@ -478,6 +479,8 @@ static struct audit_entry *audit_data_to_entry(struct audit_rule_data *data,
 				goto exit_free;
 			break;
 		case AUDIT_SESSIONID:
+			if (!sessionid_valid(f->val))
+				goto exit_free;
 		case AUDIT_ARCH:
 			entry->rule.arch_f = f;
 			break;

kernel/auditsc.c +4 -3

index 52f7a61..4df536b 100644
@@ -447,7 +447,6 @@ static int audit_filter_rules(struct task_struct *tsk,
 	const struct cred *cred;
 	int i, need_sid = 1;
 	u32 sid;
-	unsigned int sessionid;
 
 	cred = rcu_dereference_check(tsk->cred, tsk == current || task_creation);

@@ -511,8 +510,7 @@ static int audit_filter_rules(struct task_struct *tsk,
 			result = audit_gid_comparator(cred->fsgid, f->op, f->gid);
 			break;
 		case AUDIT_SESSIONID:
-			sessionid = audit_get_sessionid(current);
-			result = audit_comparator(sessionid, f->op, f->val);
+			result = audit_comparator(audit_get_sessionid(tsk), f->op, f->val);
 			break;
 		case AUDIT_PERS:
 			result = audit_comparator(tsk->personality, f->op, f->val);

@@ -614,6 +612,9 @@ static int audit_filter_rules(struct task_struct *tsk,
 		case AUDIT_LOGINUID_SET:
 			result = audit_comparator(audit_loginuid_set(tsk), f->op, f->val);
 			break;
+		case AUDIT_SESSIONID_SET:
+			result = audit_comparator(audit_sessionid_set(tsk), f->op, f->val);
+			break;
 		case AUDIT_SUBJ_USER:
 		case AUDIT_SUBJ_ROLE:
 		case AUDIT_SUBJ_TYPE:

Signature · 1 line

1.7.1

Richard Guy Briggs

author

2016-08-18 17:43 UTC #3 lore raw

PATCH v3 3/3 audit: add sessionid filter extension to feature bitmap

In reply to Richard Guy Briggs

Add to the audit feature bitmap to indicate availability of the extension of the exclude and user filters to include sessionID.

RFE: add a session ID filter to the kernel's user filter
https://github.com/linux-audit/audit-kernel/issues/4

Signed-off-by Richard Guy Briggs <[email protected]>

---
 include/uapi/linux/audit.h |    4 +++-
 1 files changed, 3 insertions(+), 1 deletions(-)

include/uapi/linux/audit.h +3 -1

index a4048bc..d4a9589 100644
@@ -329,9 +329,11 @@ enum {
 #define AUDIT_FEATURE_BITMAP_BACKLOG_LIMIT	0x00000001
 #define AUDIT_FEATURE_BITMAP_BACKLOG_WAIT_TIME	0x00000002
 #define AUDIT_FEATURE_BITMAP_EXECUTABLE_PATH	0x00000004
+#define AUDIT_FEATURE_BITMAP_SESSIONID_FILTER	0x00000010
 #define AUDIT_FEATURE_BITMAP_ALL (AUDIT_FEATURE_BITMAP_BACKLOG_LIMIT | \
 				  AUDIT_FEATURE_BITMAP_BACKLOG_WAIT_TIME | \
-				  AUDIT_FEATURE_BITMAP_EXECUTABLE_PATH)
+				  AUDIT_FEATURE_BITMAP_EXECUTABLE_PATH | \
+				  AUDIT_FEATURE_BITMAP_SESSIONID_FILTER)
 
 /* deprecated: AUDIT_VERSION_* */
 #define AUDIT_VERSION_LATEST 		AUDIT_FEATURE_BITMAP_ALL

Signature · 1 line

1.7.1

Paul Moore

maintainer

2016-08-18 23:53 UTC #4 lore raw

In reply to Richard Guy Briggs

Quoted 22 lines · Richard Guy Briggs

https://github.com/linux-audit/audit-kernel/wiki/RFE-Session-ID-User-Filter
RFE Session ID User Filter
https://github.com/linux-audit/audit-kernel/issues/4
RFE: add a session ID filter to the kernel's user filter
See also the set of userspace suport patches:
Add support for sessionid user filters, sessionid_set and loginuid_set
https://www.redhat.com/archives/linux-audit/2016-August/msg00005.html
(userspace update expected to be posted 2016-08-18)
and the test case:
https://github.com/rgbriggs/audit-testsuite/tree/ghak4-test-for-sessionID-user-filter
This third patch is expected to have a merge conflict with:
"audit: add exclude filter extension to feature bitmap"
posted on 2016-08-18.
Richard Guy Briggs (3):
audit: add support for session ID user filter
audit: add AUDIT_SESSIONID_SET support
audit: add sessionid filter extension to feature bitmap

Quoted 5 lines

 include/linux/audit.h      |   10 ++++++++++
 include/uapi/linux/audit.h |    6 +++++-
 kernel/auditfilter.c       |    5 +++++
 kernel/auditsc.c           |    6 ++++++
 4 files changed, 26 insertions(+), 1 deletions(-)

These patches look fine to me; the only comment I have is that these should probably be combined into a single patch to avoid cherry-picking of individual pieces, e.g. skipping the feature bitmap or AUDIT_SESSION_SET support. I can do that when I merge the patches, no need to resend unless you really want to ...

However, the bigger issue is coordination with the userspace patches. I really don't like merging kernel patches until Steve OK's the corresponding userspace patches.

Signature · 2 lines

paul moore
www.paul-moore.com

Richard Guy Briggs

author

2016-08-19 04:36 UTC #5 lore raw

Quoted 35 lines · Paul Moore

Quoted 22 lines · Richard Guy Briggs
https://github.com/linux-audit/audit-kernel/wiki/RFE-Session-ID-User-Filter
RFE Session ID User Filter
https://github.com/linux-audit/audit-kernel/issues/4
RFE: add a session ID filter to the kernel's user filter
See also the set of userspace suport patches:
Add support for sessionid user filters, sessionid_set and loginuid_set
https://www.redhat.com/archives/linux-audit/2016-August/msg00005.html
(userspace update expected to be posted 2016-08-18)
and the test case:
https://github.com/rgbriggs/audit-testsuite/tree/ghak4-test-for-sessionID-user-filter
This third patch is expected to have a merge conflict with:
"audit: add exclude filter extension to feature bitmap"
posted on 2016-08-18.
Richard Guy Briggs (3):
audit: add support for session ID user filter
audit: add AUDIT_SESSIONID_SET support
audit: add sessionid filter extension to feature bitmap
Quoted 5 lines
 include/linux/audit.h      |   10 ++++++++++
 include/uapi/linux/audit.h |    6 +++++-
 kernel/auditfilter.c       |    5 +++++
 kernel/auditsc.c           |    6 ++++++
 4 files changed, 26 insertions(+), 1 deletions(-)
These patches look fine to me; the only comment I have is that these should probably be combined into a single patch to avoid cherry-picking of individual pieces, e.g. skipping the feature bitmap or AUDIT_SESSION_SET support. I can do that when I merge the patches, no need to resend unless you really want to ...

Quoted 3 lines

However, the bigger issue is coordination with the userspace patches. I really don't like merging kernel patches until Steve OK's the corresponding userspace patches.

Well, some thought went in to making the two behave properly in the absence of an update of the other. This was the primary reason for the re-spin. That part of the process is working, since it was Steve's feedback that provoked the respin.

Quoted 1 line

paul moore

- RGB

--
Richard Guy Briggs <[email protected]>
Kernel Security Engineering, Base Operating Systems, Red Hat Remote, Ottawa, Canada
Voice: +1.647.777.2635, Internal: (81) 32635

Paul Moore

maintainer

2016-08-19 12:22 UTC #6 lore raw

Quoted 7 lines · Richard Guy Briggs

Quoted 6 lines · Paul Moore
These patches look fine to me; the only comment I have is that these should probably be combined into a single patch to avoid cherry-picking of individual pieces, e.g. skipping the feature bitmap or AUDIT_SESSION_SET support. I can do that when I merge the patches, no need to resend unless you really want to ...

Quoted 8 lines

Quoted 3 lines
However, the bigger issue is coordination with the userspace patches. I really don't like merging kernel patches until Steve OK's the corresponding userspace patches.
Well, some thought went in to making the two behave properly in the absence of an update of the other. This was the primary reason for the re-spin. That part of the process is working, since it was Steve's feedback that provoked the respin.

The issues isn't so much in making the different bits behave under different circumstances - they need to do that period - the issue is that I don't want to include new functionality in the kernel that doesn't have a user (or one on the horizon).

Signature · 2 lines

paul moore
www.paul-moore.com

Paul Moore

maintainer

2016-08-19 19:08 UTC #7 lore raw

In reply to Paul Moore

Quoted 35 lines · Paul Moore

Quoted 22 lines · Richard Guy Briggs
https://github.com/linux-audit/audit-kernel/wiki/RFE-Session-ID-User-Filter
RFE Session ID User Filter
https://github.com/linux-audit/audit-kernel/issues/4
RFE: add a session ID filter to the kernel's user filter
See also the set of userspace suport patches:
Add support for sessionid user filters, sessionid_set and loginuid_set
https://www.redhat.com/archives/linux-audit/2016-August/msg00005.html
(userspace update expected to be posted 2016-08-18)
and the test case:
https://github.com/rgbriggs/audit-testsuite/tree/ghak4-test-for-sessionID-user-filter
This third patch is expected to have a merge conflict with:
"audit: add exclude filter extension to feature bitmap"
posted on 2016-08-18.
Richard Guy Briggs (3):
audit: add support for session ID user filter
audit: add AUDIT_SESSIONID_SET support
audit: add sessionid filter extension to feature bitmap
Quoted 5 lines
 include/linux/audit.h      |   10 ++++++++++
 include/uapi/linux/audit.h |    6 +++++-
 kernel/auditfilter.c       |    5 +++++
 kernel/auditsc.c           |    6 ++++++
 4 files changed, 26 insertions(+), 1 deletions(-)
These patches look fine to me; the only comment I have is that these should probably be combined into a single patch to avoid cherry-picking of individual pieces, e.g. skipping the feature bitmap or AUDIT_SESSION_SET support. I can do that when I merge the patches, no need to resend unless you really want to ...

Quoted 3 lines

However, the bigger issue is coordination with the userspace patches. I really don't like merging kernel patches until Steve OK's the corresponding userspace patches.

I went ahead and squashed the patches into one and merged it into the audit#working-session_filter-v3 branch. Take a look and if anything looks awry let me know.

I'm also going to start including this patch/branch in my pcmoore/kernel-secnext Copr builds so it is easier for you/sgrubb to test the userspace support; once Steve OK's the userspace code I'll merge this patch(set) into audit#next properly.

* https://github.com/linux-audit/audit-kernel/issues/4
* https://copr.fedorainfracloud.org/coprs/pcmoore/kernel-secnext

Signature · 2 lines

paul moore
www.paul-moore.com

Paul Moore

2016-10-20 19:27 UTC #8 lore raw

In reply to Richard Guy Briggs

Quoted 23 lines · Richard Guy Briggs

https://github.com/linux-audit/audit-kernel/wiki/RFE-Session-ID-User-Filter
RFE Session ID User Filter
https://github.com/linux-audit/audit-kernel/issues/4
RFE: add a session ID filter to the kernel's user filter
See also the set of userspace suport patches:
Add support for sessionid user filters, sessionid_set and loginuid_set
https://www.redhat.com/archives/linux-audit/2016-August/msg00005.html
(userspace update expected to be posted 2016-08-18)
and the test case:
https://github.com/rgbriggs/audit-testsuite/tree/ghak4-test-for-sessionID-u
ser-filter
This third patch is expected to have a merge conflict with:
"audit: add exclude filter extension to feature bitmap"
posted on 2016-08-18.
Richard Guy Briggs (3):
audit: add support for session ID user filter
audit: add AUDIT_SESSIONID_SET support
audit: add sessionid filter extension to feature bitmap

Quoted 5 lines

 include/linux/audit.h      |   10 ++++++++++
 include/uapi/linux/audit.h |    6 +++++-
 kernel/auditfilter.c       |    5 +++++
 kernel/auditsc.c           |    6 ++++++
 4 files changed, 26 insertions(+), 1 deletions(-)

In light of our current decision to drop the session ID "set" filter, I'm taking another look at these patches and Richard's comment to simply drop patch 2/3 and apply 1/3 and 3/3.

Richard, as I mentioned earlier, perhaps not clearly enough, I think we should put a check in audit_set_loginuid() to skip the (int)-1 value from appearing in session_id during normal operation. In other words, roll/reset the value in session_id one value early so we don't run into problems with the (int)-1 unset sentinel value.

Signature · 2 lines

paul moore
security @ redhat

Richard Guy Briggs

author

2016-10-21 06:46 UTC #9 lore raw

Quoted 34 lines · Paul Moore

Quoted 23 lines · Richard Guy Briggs
https://github.com/linux-audit/audit-kernel/wiki/RFE-Session-ID-User-Filter
RFE Session ID User Filter
https://github.com/linux-audit/audit-kernel/issues/4
RFE: add a session ID filter to the kernel's user filter
See also the set of userspace suport patches:
Add support for sessionid user filters, sessionid_set and loginuid_set
https://www.redhat.com/archives/linux-audit/2016-August/msg00005.html
(userspace update expected to be posted 2016-08-18)
and the test case:
https://github.com/rgbriggs/audit-testsuite/tree/ghak4-test-for-sessionID-u
ser-filter
This third patch is expected to have a merge conflict with:
"audit: add exclude filter extension to feature bitmap"
posted on 2016-08-18.
Richard Guy Briggs (3):
audit: add support for session ID user filter
audit: add AUDIT_SESSIONID_SET support
audit: add sessionid filter extension to feature bitmap
Quoted 5 lines
 include/linux/audit.h      |   10 ++++++++++
 include/uapi/linux/audit.h |    6 +++++-
 kernel/auditfilter.c       |    5 +++++
 kernel/auditsc.c           |    6 ++++++
 4 files changed, 26 insertions(+), 1 deletions(-)
In light of our current decision to drop the session ID "set" filter, I'm taking another look at these patches and Richard's comment to simply drop patch 2/3 and apply 1/3 and 3/3.

Quoted 5 lines

Richard, as I mentioned earlier, perhaps not clearly enough, I think we should put a check in audit_set_loginuid() to skip the (int)-1 value from appearing in session_id during normal operation. In other words, roll/reset the value in session_id one value early so we don't run into problems with the (int)-1 unset sentinel value.

I noted your comment earlier and I agree skipping the sentinel is required, but if we are rolling this counter, we have bigger issues unless there is a way to determine if a sessionID value is still in use by at least one task.

Quoted 1 line

paul moore

- RGB

--
Richard Guy Briggs <[email protected]>
Kernel Security Engineering, Base Operating Systems, Red Hat Remote, Ottawa, Canada
Voice: +1.647.777.2635, Internal: (81) 32635

Paul Moore

maintainer

2016-10-21 17:03 UTC #10 lore raw

Quoted 41 lines · Richard Guy Briggs

Quoted 34 lines · Paul Moore
Quoted 23 lines · Richard Guy Briggs
https://github.com/linux-audit/audit-kernel/wiki/RFE-Session-ID-User-Filter
RFE Session ID User Filter
https://github.com/linux-audit/audit-kernel/issues/4
RFE: add a session ID filter to the kernel's user filter
See also the set of userspace suport patches:
Add support for sessionid user filters, sessionid_set and loginuid_set
https://www.redhat.com/archives/linux-audit/2016-August/msg00005.html
(userspace update expected to be posted 2016-08-18)
and the test case:
https://github.com/rgbriggs/audit-testsuite/tree/ghak4-test-for-sessionID-u
ser-filter
This third patch is expected to have a merge conflict with:
"audit: add exclude filter extension to feature bitmap"
posted on 2016-08-18.
Richard Guy Briggs (3):
audit: add support for session ID user filter
audit: add AUDIT_SESSIONID_SET support
audit: add sessionid filter extension to feature bitmap
Quoted 5 lines
 include/linux/audit.h      |   10 ++++++++++
 include/uapi/linux/audit.h |    6 +++++-
 kernel/auditfilter.c       |    5 +++++
 kernel/auditsc.c           |    6 ++++++
 4 files changed, 26 insertions(+), 1 deletions(-)
In light of our current decision to drop the session ID "set" filter, I'm taking another look at these patches and Richard's comment to simply drop patch 2/3 and apply 1/3 and 3/3.
Quoted 5 lines
Richard, as I mentioned earlier, perhaps not clearly enough, I think we should put a check in audit_set_loginuid() to skip the (int)-1 value from appearing in session_id during normal operation. In other words, roll/reset the value in session_id one value early so we don't run into problems with the (int)-1 unset sentinel value.

Quoted 4 lines

I noted your comment earlier and I agree skipping the sentinel is required, but if we are rolling this counter, we have bigger issues unless there is a way to determine if a sessionID value is still in use by at least one task.

The session ID reuse problem is independent of the rollover problem; the session ID value is going to roll at some point, regardless of if we skip one value or not. I guess if there is any comfort in the value rolling, it is only bumped on a new interactive user session and given that systemd is now taking to killing all user processes on logout (no more nohup'ing things) it is unlikely that this will be an issue on a modern Linux system (it would appear that most everyone is moving to systemd, for better or worse). For those truly paranoid admins, they don't have to filter on it - problem solved - for everyone else, it can be a useful tool.

Signature · 2 lines

paul moore
www.paul-moore.com

Paul Moore

maintainer

2016-11-20 22:04 UTC #11 lore raw

In reply to Richard Guy Briggs

Quoted 22 lines · Richard Guy Briggs

https://github.com/linux-audit/audit-kernel/wiki/RFE-Session-ID-User-Filter
RFE Session ID User Filter
https://github.com/linux-audit/audit-kernel/issues/4
RFE: add a session ID filter to the kernel's user filter
See also the set of userspace suport patches:
Add support for sessionid user filters, sessionid_set and loginuid_set
https://www.redhat.com/archives/linux-audit/2016-August/msg00005.html
(userspace update expected to be posted 2016-08-18)
and the test case:
https://github.com/rgbriggs/audit-testsuite/tree/ghak4-test-for-sessionID-user-filter
This third patch is expected to have a merge conflict with:
"audit: add exclude filter extension to feature bitmap"
posted on 2016-08-18.
Richard Guy Briggs (3):
audit: add support for session ID user filter
audit: add AUDIT_SESSIONID_SET support
audit: add sessionid filter extension to feature bitmap

Quoted 5 lines

 include/linux/audit.h      |   10 ++++++++++
 include/uapi/linux/audit.h |    6 +++++-
 kernel/auditfilter.c       |    5 +++++
 kernel/auditsc.c           |    6 ++++++
 4 files changed, 26 insertions(+), 1 deletions(-)

I just combined and merged patches 1/3 and 3/3 into the audit#next branch, skipping the AUDIT_SESSIONID_SET patch as we already discussed on list. I included the patches into the next branch because the userspace support has already been merged, but if the session ID tests and wiki feature page aren't ready by the time the next merge window opens I'm going to drop them from the pull request I send Linus.

Signature · 2 lines

paul moore
www.paul-moore.com