Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1465669 > unrolled thread

Re: [PATCH V3 0/3] Add support for session ID user filtering

Started byPaul Moore <paul@paul-moore.com>
First post2016-08-19 02:50 +0200
Last post2016-08-19 21:10 +0200
Articles 4 — 2 participants

Back to article view | Back to linux.kernel

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Re: [PATCH V3 0/3] Add support for session ID user filtering Paul Moore <paul@paul-moore.com> - 2016-08-19 02:50 +0200
    Re: [PATCH V3 0/3] Add support for session ID user filtering Richard Guy Briggs <rgb@redhat.com> - 2016-08-19 06:40 +0200
      Re: [PATCH V3 0/3] Add support for session ID user filtering Paul Moore <paul@paul-moore.com> - 2016-08-19 14:30 +0200
    Re: [PATCH V3 0/3] Add support for session ID user filtering Paul Moore <paul@paul-moore.com> - 2016-08-19 21:10 +0200

#1465669 — Re: [PATCH V3 0/3] Add support for session ID user filtering

FromPaul Moore <paul@paul-moore.com>
Date2016-08-19 02:50 +0200
SubjectRe: [PATCH V3 0/3] Add support for session ID user filtering
Message-ID<s7Gau-6Ui-31@gated-at.bofh.it>
On Thu, Aug 18, 2016 at 1:43 PM, Richard Guy Briggs <rgb@redhat.com> wrote:
> https://github.com/linux-audit/audit-kernel/wiki/RFE-Session-ID-User-Filter
> RFE Session ID User Filter
>
> https://github.com/linux-audit/audit-kernel/issues/4
> RFE: add a session ID filter to the kernel's user filter
>
> See also the set of userspace suport patches:
>         Add support for sessionid user filters, sessionid_set and loginuid_set
>         https://www.redhat.com/archives/linux-audit/2016-August/msg00005.html
>         (userspace update expected to be posted 2016-08-18)
> and the test case:
>         https://github.com/rgbriggs/audit-testsuite/tree/ghak4-test-for-sessionID-user-filter
>
> This third patch is expected to have a merge conflict with:
>         "audit: add exclude filter extension to feature bitmap"
> posted on 2016-08-18.
>
> Richard Guy Briggs (3):
>   audit: add support for session ID user filter
>   audit: add AUDIT_SESSIONID_SET support
>   audit: add sessionid filter extension to feature bitmap
>
>  include/linux/audit.h      |   10 ++++++++++
>  include/uapi/linux/audit.h |    6 +++++-
>  kernel/auditfilter.c       |    5 +++++
>  kernel/auditsc.c           |    6 ++++++
>  4 files changed, 26 insertions(+), 1 deletions(-)

These patches look fine to me; the only comment I have is that these
should probably be combined into a single patch to avoid
cherry-picking of individual pieces, e.g. skipping the feature bitmap
or AUDIT_SESSION_SET support.  I can do that when I merge the patches,
no need to resend unless you really want to ...

However, the bigger issue is coordination with the userspace patches.
I really don't like merging kernel patches until Steve OK's the
corresponding userspace patches.

-- 
paul moore
www.paul-moore.com

[toc] | [next] | [standalone]

#1465986

FromRichard Guy Briggs <rgb@redhat.com>
Date2016-08-19 06:40 +0200
Message-ID<s7JL3-V2-3@gated-at.bofh.it>
In reply to#1465669
On 2016-08-18 19:53, Paul Moore wrote:
> On Thu, Aug 18, 2016 at 1:43 PM, Richard Guy Briggs <rgb@redhat.com> wrote:
> > https://github.com/linux-audit/audit-kernel/wiki/RFE-Session-ID-User-Filter
> > RFE Session ID User Filter
> >
> > https://github.com/linux-audit/audit-kernel/issues/4
> > RFE: add a session ID filter to the kernel's user filter
> >
> > See also the set of userspace suport patches:
> >         Add support for sessionid user filters, sessionid_set and loginuid_set
> >         https://www.redhat.com/archives/linux-audit/2016-August/msg00005.html
> >         (userspace update expected to be posted 2016-08-18)
> > and the test case:
> >         https://github.com/rgbriggs/audit-testsuite/tree/ghak4-test-for-sessionID-user-filter
> >
> > This third patch is expected to have a merge conflict with:
> >         "audit: add exclude filter extension to feature bitmap"
> > posted on 2016-08-18.
> >
> > Richard Guy Briggs (3):
> >   audit: add support for session ID user filter
> >   audit: add AUDIT_SESSIONID_SET support
> >   audit: add sessionid filter extension to feature bitmap
> >
> >  include/linux/audit.h      |   10 ++++++++++
> >  include/uapi/linux/audit.h |    6 +++++-
> >  kernel/auditfilter.c       |    5 +++++
> >  kernel/auditsc.c           |    6 ++++++
> >  4 files changed, 26 insertions(+), 1 deletions(-)
> 
> These patches look fine to me; the only comment I have is that these
> should probably be combined into a single patch to avoid
> cherry-picking of individual pieces, e.g. skipping the feature bitmap
> or AUDIT_SESSION_SET support.  I can do that when I merge the patches,
> no need to resend unless you really want to ...
> 
> However, the bigger issue is coordination with the userspace patches.
> I really don't like merging kernel patches until Steve OK's the
> corresponding userspace patches.

Well, some thought went in to making the two behave properly in the
absence of an update of the other.  This was the primary reason for the
re-spin.  That part of the process is working, since it was Steve's
feedback that provoked the respin.

> paul moore

- RGB

--
Richard Guy Briggs <rgb@redhat.com>
Kernel Security Engineering, Base Operating Systems, Red Hat
Remote, Ottawa, Canada
Voice: +1.647.777.2635, Internal: (81) 32635

[toc] | [prev] | [next] | [standalone]

#1466335

FromPaul Moore <paul@paul-moore.com>
Date2016-08-19 14:30 +0200
Message-ID<s7R5U-5zh-13@gated-at.bofh.it>
In reply to#1465986
On Fri, Aug 19, 2016 at 12:36 AM, Richard Guy Briggs <rgb@redhat.com> wrote:
> On 2016-08-18 19:53, Paul Moore wrote:
>> These patches look fine to me; the only comment I have is that these
>> should probably be combined into a single patch to avoid
>> cherry-picking of individual pieces, e.g. skipping the feature bitmap
>> or AUDIT_SESSION_SET support.  I can do that when I merge the patches,
>> no need to resend unless you really want to ...
>>
>> However, the bigger issue is coordination with the userspace patches.
>> I really don't like merging kernel patches until Steve OK's the
>> corresponding userspace patches.
>
> Well, some thought went in to making the two behave properly in the
> absence of an update of the other.  This was the primary reason for the
> re-spin.  That part of the process is working, since it was Steve's
> feedback that provoked the respin.

The issues isn't so much in making the different bits behave under
different circumstances - they need to do that period - the issue is
that I don't want to include new functionality in the kernel that
doesn't have a user (or one on the horizon).

-- 
paul moore
www.paul-moore.com

[toc] | [prev] | [next] | [standalone]

#1466616

FromPaul Moore <paul@paul-moore.com>
Date2016-08-19 21:10 +0200
Message-ID<s7XkZ-18q-3@gated-at.bofh.it>
In reply to#1465669
On Thu, Aug 18, 2016 at 7:53 PM, Paul Moore <paul@paul-moore.com> wrote:
> On Thu, Aug 18, 2016 at 1:43 PM, Richard Guy Briggs <rgb@redhat.com> wrote:
>> https://github.com/linux-audit/audit-kernel/wiki/RFE-Session-ID-User-Filter
>> RFE Session ID User Filter
>>
>> https://github.com/linux-audit/audit-kernel/issues/4
>> RFE: add a session ID filter to the kernel's user filter
>>
>> See also the set of userspace suport patches:
>>         Add support for sessionid user filters, sessionid_set and loginuid_set
>>         https://www.redhat.com/archives/linux-audit/2016-August/msg00005.html
>>         (userspace update expected to be posted 2016-08-18)
>> and the test case:
>>         https://github.com/rgbriggs/audit-testsuite/tree/ghak4-test-for-sessionID-user-filter
>>
>> This third patch is expected to have a merge conflict with:
>>         "audit: add exclude filter extension to feature bitmap"
>> posted on 2016-08-18.
>>
>> Richard Guy Briggs (3):
>>   audit: add support for session ID user filter
>>   audit: add AUDIT_SESSIONID_SET support
>>   audit: add sessionid filter extension to feature bitmap
>>
>>  include/linux/audit.h      |   10 ++++++++++
>>  include/uapi/linux/audit.h |    6 +++++-
>>  kernel/auditfilter.c       |    5 +++++
>>  kernel/auditsc.c           |    6 ++++++
>>  4 files changed, 26 insertions(+), 1 deletions(-)
>
> These patches look fine to me; the only comment I have is that these
> should probably be combined into a single patch to avoid
> cherry-picking of individual pieces, e.g. skipping the feature bitmap
> or AUDIT_SESSION_SET support.  I can do that when I merge the patches,
> no need to resend unless you really want to ...
>
> However, the bigger issue is coordination with the userspace patches.
> I really don't like merging kernel patches until Steve OK's the
> corresponding userspace patches.

I went ahead and squashed the patches into one and merged it into the
audit#working-session_filter-v3 branch.  Take a look and if anything
looks awry let me know.

I'm also going to start including this patch/branch in my
pcmoore/kernel-secnext Copr builds so it is easier for you/sgrubb to
test the userspace support; once Steve OK's the userspace code I'll
merge this patch(set) into audit#next properly.

* https://github.com/linux-audit/audit-kernel/issues/4
* https://copr.fedorainfracloud.org/coprs/pcmoore/kernel-secnext

-- 
paul moore
www.paul-moore.com

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web