lkml.org 
[lkml]   [2014]   [Oct]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH V5 11/13] audit: emit AUDIT_NS_INFO record with AUDIT_VIRT_CONTROL record
    Quoting Richard Guy Briggs (rgb@redhat.com):
    > Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
    > ---
    > include/uapi/linux/audit.h | 2 ++
    > kernel/audit.c | 2 ++
    > 2 files changed, 4 insertions(+), 0 deletions(-)
    >
    > diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h
    > index 7ec7209..beb23f7 100644
    > --- a/include/uapi/linux/audit.h
    > +++ b/include/uapi/linux/audit.h
    > @@ -163,6 +163,8 @@
    >
    > #define AUDIT_KERNEL 2000 /* Asynchronous audit record. NOT A REQUEST. */
    >
    > +#define AUDIT_VIRT_CONTROL 2500 /* Start, Pause, Stop VM */
    > +
    > /* Rule flags */
    > #define AUDIT_FILTER_USER 0x00 /* Apply rule to user-generated messages */
    > #define AUDIT_FILTER_TASK 0x01 /* Apply rule at task creation (not syscall) */
    > diff --git a/kernel/audit.c b/kernel/audit.c
    > index 84590d1..5404c24 100644
    > --- a/kernel/audit.c
    > +++ b/kernel/audit.c
    > @@ -941,6 +941,8 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
    > }
    > audit_set_portid(ab, NETLINK_CB(skb).portid);
    > audit_log_end(ab);
    > + if (msg_type == AUDIT_VIRT_CONTROL)
    > + audit_log_ns_info(NULL);

    AFAICT your patchset leaves audit_log_ns_info() immediately returning if
    arg1 is NULL. Is handling that coming later? Why not leave this until
    that patch comes?

    > mutex_lock(&audit_cmd_mutex);
    > }
    > break;
    > --
    > 1.7.1


    \
     
     \ /
      Last update: 2014-10-13 16:01    [W:4.059 / U:2.736 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site