Re: [PATCH 1/1] NetLabel: add audit support for configuration changes

2006-09-29 Thread David Miller
From: Paul Moore <[EMAIL PROTECTED]> Date: Fri, 29 Sep 2006 16:28:36 -0400 > I think Steve and I have agreed on a solution, I'll put together a patch > right now based on what is currently in net-2.6 (i.e. the existing > NetLabel audit patch) and submit it to the lists in a few hours. Great, I'll

Re: [PATCH 1/1] NetLabel: add audit support for configuration changes

2006-09-29 Thread Paul Moore
Dave, I think Steve and I have agreed on a solution, I'll put together a patch right now based on what is currently in net-2.6 (i.e. the existing NetLabel audit patch) and submit it to the lists in a few hours. Steve Grubb wrote: > On Friday 29 September 2006 14:09, Paul Moore wrote: > >>>type f

Re: [PATCH 1/1] NetLabel: add audit support for configuration changes

2006-09-29 Thread Paul Moore
Steve Grubb wrote: > On Thursday 28 September 2006 14:03, [EMAIL PROTECTED] wrote: >>@@ -381,21 +380,35 @@ static int netlbl_cipsov4_add(struct sk_ >> >> { >> int ret_val = -EINVAL; >>- u32 map_type; >>+ u32 type; >>+ u32 doi; >>+ const char *type_str = "(unknown)"; >>+ str

Re: [PATCH 1/1] NetLabel: add audit support for configuration changes

2006-09-29 Thread Paul Moore
James Morris wrote: > Dave, > > Looks like this patch needs to be reverted until these issues are > resolved. Yes, please revert this patch. I posted an earlier version to the linux-audit list and waited for a day to see if there any comments before submitting for inclusion, but unfortunately i

Re: [PATCH 1/1] NetLabel: add audit support for configuration changes

2006-09-29 Thread James Morris
Dave, Looks like this patch needs to be reverted until these issues are resolved. On Fri, 29 Sep 2006, Steve Grubb wrote: > On Thursday 28 September 2006 14:03, [EMAIL PROTECTED] wrote: > > This patch adds audit support to NetLabel, including six new audit message > > types shown below. > > >

Re: [PATCH 1/1] NetLabel: add audit support for configuration changes

2006-09-29 Thread Steve Grubb
On Thursday 28 September 2006 14:03, [EMAIL PROTECTED] wrote: > This patch adds audit support to NetLabel, including six new audit message > types shown below. > > #define AUDIT_MAC_UNLBL_ACCEPT 1406 > #define AUDIT_MAC_UNLBL_DENY 1407 > #define AUDIT_MAC_CIPSOV4_ADD 1408 > #define AUDIT_MAC

Re: [PATCH 1/1] NetLabel: add audit support for configuration changes

2006-09-28 Thread David Miller
From: James Morris <[EMAIL PROTECTED]> Date: Thu, 28 Sep 2006 15:50:42 -0400 (EDT) > > > +struct audit_buffer *netlbl_audit_start_common(int type, u32 secid) > > > + if (current->mm) { > > + down_read(¤t->mm->mmap_sem); > > + vma = current->mm->mmap; > > + while (

Re: [PATCH 1/1] NetLabel: add audit support for configuration changes

2006-09-28 Thread Paul Moore
James Morris wrote: > On Thu, 28 Sep 2006, Paul Moore wrote: > >>Agreed, in fact, as I suspect you have already noticed, this was ripped >>right from that function. It was private to kernel/auditsc.c making it >>offlimits, but I would have gladly used it instead; making >>audit_log_task_info() pu

Re: [PATCH 1/1] NetLabel: add audit support for configuration changes

2006-09-28 Thread James Morris
On Thu, 28 Sep 2006, Paul Moore wrote: > Agreed, in fact, as I suspect you have already noticed, this was ripped > right from that function. It was private to kernel/auditsc.c making it > offlimits, but I would have gladly used it instead; making > audit_log_task_info() public seemed like somethi

Re: [PATCH 1/1] NetLabel: add audit support for configuration changes

2006-09-28 Thread Paul Moore
James Morris wrote: >>+struct audit_buffer *netlbl_audit_start_common(int type, u32 secid) > > >>+ if (current->mm) { >>+ down_read(¤t->mm->mmap_sem); >>+ vma = current->mm->mmap; >>+ while (vma) { >>+ if ((vma->vm_flags & VM_EXECUTABLE)

Re: [PATCH 1/1] NetLabel: add audit support for configuration changes

2006-09-28 Thread James Morris
> +struct audit_buffer *netlbl_audit_start_common(int type, u32 secid) > + if (current->mm) { > + down_read(¤t->mm->mmap_sem); > + vma = current->mm->mmap; > + while (vma) { > + if ((vma->vm_flags & VM_EXECUTABLE) && > +