Messages in this thread | | | From | Paul Moore <> | Date | Tue, 28 Apr 2020 18:15:22 -0400 | Subject | Re: [PATCH ghak25 v4 1/3] audit: tidy and extend netfilter_cfg x_tables and ebtables logging |
| |
On Wed, Apr 22, 2020 at 5:40 PM Richard Guy Briggs <rgb@redhat.com> wrote: > > NETFILTER_CFG record generation was inconsistent for x_tables and > ebtables configuration changes. The call was needlessly messy and there > were supporting records missing at times while they were produced when > not requested. Simplify the logging call into a new audit_log_nfcfg > call. Honour the audit_enabled setting while more consistently > recording information including supporting records by tidying up dummy > checks. > > Add an op= field that indicates the operation being performed (register > or replace). > > Here is the enhanced sample record: > type=NETFILTER_CFG msg=audit(1580905834.919:82970): table=filter family=2 entries=83 op=replace > > Generate audit NETFILTER_CFG records on ebtables table registration. > Previously this was being done for x_tables registration and replacement > operations and ebtables table replacement only. > > See: https://github.com/linux-audit/audit-kernel/issues/25 > See: https://github.com/linux-audit/audit-kernel/issues/35 > See: https://github.com/linux-audit/audit-kernel/issues/43 > > Signed-off-by: Richard Guy Briggs <rgb@redhat.com> > --- > include/linux/audit.h | 21 +++++++++++++++++++++ > kernel/auditsc.c | 24 ++++++++++++++++++++++++ > net/bridge/netfilter/ebtables.c | 12 ++++-------- > net/netfilter/x_tables.c | 12 +++--------- > 4 files changed, 52 insertions(+), 17 deletions(-)
Merged into audit/next, thanks.
-- paul moore www.paul-moore.com
| |