Follow up on command line auditing
William Roberts
bill.c.roberts at gmail.com
Mon Dec 2 18:10:27 UTC 2013
On Mon, Dec 2, 2013 at 9:18 AM, Richard Guy Briggs <rgb at redhat.com> wrote:
> On Mon, Dec 02, 2013 at 08:20:10AM -0800, William Roberts wrote:
>> On Mon, Dec 2, 2013 at 8:07 AM, Richard Guy Briggs <rgb at redhat.com> wrote:
>> > On Mon, Dec 02, 2013 at 07:42:20AM -0800, William Roberts wrote:
>> >> Changelog since last post:
>> >> * Rebase on latest master
>> >>
>> >> [PATCH] audit: Audit proc cmdline value
>> >
>> > Hi Bill,
>> >
>> > I wasn't expecting that you would squash everything down into one patch.
>> > I think it should be at least two. I'm comfortable with the changes in
>> > the audit subsystem. Could those be one patch? As for the changes to
>> > proc (including base and util) those might be better as a seperate
>> > patch.
>>
>> Richard,
>> Ok so what do you think the best way forward is? I don't want to duplicate
>> code from proc/base.c. I would need to export proc_pid_cmdline()
>> in the first patch or re-implement it in the audit subsystem, followed
>> by a patch
>> to merge the functionality. What would you prefer?
>
> I would split them into 3 patches:
>
> 1) implement the length and copy funcitons:
> include/linux/mm.h | 7 +++++
> mm/util.c | 48 ++++++++++++++++++++++++++++++
>
> 2) use them in the proc call:
> fs/proc/base.c | 35 +++++++---------------
>
> 3) use them in audit:
> kernel/audit.h | 1 +
> kernel/auditsc.c | 82 ++++++++++++++++++++++++++++++++++++++++++++++++++++
>
>
> Does this split make sense? Combining 1 and 2 might be acceptable to
> those subsystem maintainers...
You read my mind here after I sent this, this is exactly what I was thinking.
When I am done do I publish this to kernel mainline, here, or elsewhere?
Bill
<snip>
More information about the Linux-audit
mailing list