Will, my sincere apologies, I was unaware Google had written one up ( I've only ever been looking at Jellybean's external directory these days). Where's the code for your audit port hanging out? I'm really glad to see someone took the time and did it right. Thanks!<br>
<br>Cheers,<br>Nathaniel<br><br><div class="gmail_quote">On Tue, Jun 18, 2013 at 4:09 PM, William Roberts <span dir="ltr"><<a href="mailto:bill.c.roberts@gmail.com" target="_blank">bill.c.roberts@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Nathan,<div><br></div><div>The "robust port that Google has" was done by me, so we can always use that :-P The newest features that i back-ported from the upstream kernel were for a separate feature need that came about when I was at Samsung, which was the need to send the kernel messages to both kmsg and a userspace auditd. Eric created a patch for a more generic feature setting and retrieval implementation on the kernel side, that I rebased my kernel patch for the "always send to kmsg feature" onto. They were tested on the desktop, seemed to be fine. I just haven't had the time to get back to the Android port to test it; likely it will be fine. I just wanted to keep Eric/community abreast of my porting activity.</div>
<div><br></div><div>FYI I saw your port early on, the reason I wrote one from scratch was due to the license issues.</div><div><br></div><div>Bill</div></div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br>
<br><div class="gmail_quote">
On Tue, Jun 18, 2013 at 1:19 PM, Nathaniel Husted <span dir="ltr"><<a href="mailto:nhusted@gmail.com" target="_blank">nhusted@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
If you'd like to test your patch out I have a userland fork of audit you can use (<a href="https://github.com/nwhusted/AuditdAndroid" target="_blank">https://github.com/nwhusted/AuditdAndroid</a>). For various reasons we gutted the networking implementation in userland and shoved audisp's AF_Unix plugin where auditd's networking should be (don't ask). Only auditd and auditctl will compile (the other programs have certain GNU/libc stuff that I didn't write bridge-code for), but that should be more then enough to run through some logging on Android.<br>
<br>At some point I'll have time to go back and make a robust port of audit as Google has started (hopefully) getting there stuff together and turning bionic from a piece of junk into something usable.<br><br>Cheers,<br>
Nathaniel<br><br><div class="gmail_quote"><div><div>On Mon, Jun 17, 2013 at 10:08 AM, William Roberts <span dir="ltr"><<a href="mailto:bill.c.roberts@gmail.com" target="_blank">bill.c.roberts@gmail.com</a>></span> wrote:<br>
</div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div><div dir="ltr"><div>So I ported the initial "<span style="font-size:9pt">audit: implement generic feature setting and retrieving" to Android as well as rebased my patch ontop. Since I didn't author the original patch, I just wanted to keep you abreast of where it was going.</span></div>
<div><span style="font-size:9pt;font-weight:bold"><br></span></div><a href="https://android-review.googlesource.com/#/c/60880/" target="_blank">https://android-review.googlesource.com/#/c/60880/</a><span><font color="#888888"><br clear="all">
<div><br>
</div>-- <br>Respectfully,<br><br>William C Roberts<br><br>
</font></span></div>
<br></div></div><span><font color="#888888">--<br>
Linux-audit mailing list<br>
<a href="mailto:Linux-audit@redhat.com" target="_blank">Linux-audit@redhat.com</a><br>
<a href="https://www.redhat.com/mailman/listinfo/linux-audit" target="_blank">https://www.redhat.com/mailman/listinfo/linux-audit</a><br></font></span></blockquote></div><br>
</blockquote></div><br><br clear="all"><div><br></div>-- <br>Respectfully,<br><br>William C Roberts<br><br>
</div>
</div></div></blockquote></div><br>