Re: [PATCH] audit: skip sessionid sentinel value when auto-incrementing

From	Paul Moore <paul@paul-moore.com>
Newsgroups	linux.kernel
Subject	Re: [PATCH] audit: skip sessionid sentinel value when auto-incrementing
Date	2016-11-20 21:40 +0100
Message-ID	<sFH45-8m0-3@gated-at.bofh.it> (permalink)
References	<sBRlo-1Xo-5@gated-at.bofh.it> <sDvTs-3iu-23@gated-at.bofh.it> <sDHBg-2C3-31@gated-at.bofh.it> <sEErD-7rZ-13@gated-at.bofh.it> <sEH6a-RN-7@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Thu, Nov 17, 2016 at 9:27 PM, Richard Guy Briggs <rgb@redhat.com> wrote:
> On 2016-11-17 18:34, Paul Moore wrote:
>> On Tue, Nov 15, 2016 at 3:49 AM, Richard Guy Briggs <rgb@redhat.com> wrote:
>> > On 2016-11-14 15:17, Paul Moore wrote:
>> >> On Thu, Nov 10, 2016 at 1:41 AM, Richard Guy Briggs <rgb@redhat.com> wrote:
>> >> > The value (unsigned int)-1 is used as a sentinel to indicate the
>> >> > sessionID is unset.  Skip this value when the session_id value wraps.
>> >> >
>> >> > Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
>> >> > ---
>> >> >  kernel/auditsc.c |    5 ++++-
>> >> >  1 files changed, 4 insertions(+), 1 deletions(-)
>> >>
>> >> Since we haven't merged the session ID kernel patches into audit#next
>> >> yet, why don't you just squash this patch in with the session ID patch
>> >> and resubmit upstream in one nice neat patch.
>> >
>> > This was an existing bug regardless of new functionality added, so the
>> > fix should not be buried in a new feature patch.
>>
>> No, it's not an existing bug.  The existing code simply reports/logs
>> the session ID, it doesn't filter on it, so there are no magic values
>> to worry about.
>
> The existing code autoincrements through sessionID==-1.  The existing
> code (ausearch and aureport) reports and logs the sessionID and there
> are existing reporting tools that are able to filter on sessionID even
> though kernel filters don't yet exist for them.  Therefore, it is
> possible for the counter to roll and to erroneously report that the
> value is unset.

I hadn't realize that the audit userspace was using this as an unset
value.  Anyway, merged.

-- 
paul moore
www.paul-moore.com

Back to linux.kernel | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Re: [PATCH] audit: skip sessionid sentinel value when auto-incrementing Paul Moore <paul@paul-moore.com> - 2016-11-14 21:20 +0100
  Re: [PATCH] audit: skip sessionid sentinel value when  auto-incrementing Richard Guy Briggs <rgb@redhat.com> - 2016-11-15 09:50 +0100
    Re: [PATCH] audit: skip sessionid sentinel value when auto-incrementing Paul Moore <paul@paul-moore.com> - 2016-11-18 00:40 +0100
      Re: [PATCH] audit: skip sessionid sentinel value when  auto-incrementing Richard Guy Briggs <rgb@redhat.com> - 2016-11-18 03:30 +0100
        Re: [PATCH] audit: skip sessionid sentinel value when auto-incrementing Paul Moore <paul@paul-moore.com> - 2016-11-20 21:40 +0100

csiph-web