Follow up on command line auditing
Richard Guy Briggs
rgb at redhat.com
Mon Dec 2 18:19:37 UTC 2013
On Mon, Dec 02, 2013 at 10:10:27AM -0800, William Roberts wrote:
> On Mon, Dec 2, 2013 at 9:18 AM, Richard Guy Briggs <rgb at redhat.com> wrote:
> > On Mon, Dec 02, 2013 at 08:20:10AM -0800, William Roberts wrote:
> >> On Mon, Dec 2, 2013 at 8:07 AM, Richard Guy Briggs <rgb at redhat.com> wrote:
> >> > On Mon, Dec 02, 2013 at 07:42:20AM -0800, William Roberts wrote:
> >> >> Changelog since last post:
> >> >> * Rebase on latest master
> >> >>
> >> >> [PATCH] audit: Audit proc cmdline value
> >> >
> >> > Hi Bill,
> >> >
> >> > I wasn't expecting that you would squash everything down into one patch.
> >> > I think it should be at least two. I'm comfortable with the changes in
> >> > the audit subsystem. Could those be one patch? As for the changes to
> >> > proc (including base and util) those might be better as a seperate
> >> > patch.
> >>
> >> Richard,
> >> Ok so what do you think the best way forward is? I don't want to duplicate
> >> code from proc/base.c. I would need to export proc_pid_cmdline()
> >> in the first patch or re-implement it in the audit subsystem, followed
> >> by a patch
> >> to merge the functionality. What would you prefer?
> >
> > I would split them into 3 patches:
> >
> > 1) implement the length and copy funcitons:
> > include/linux/mm.h | 7 +++++
> > mm/util.c | 48 ++++++++++++++++++++++++++++++
> >
> > 2) use them in the proc call:
> > fs/proc/base.c | 35 +++++++---------------
> >
> > 3) use them in audit:
> > kernel/audit.h | 1 +
> > kernel/auditsc.c | 82 ++++++++++++++++++++++++++++++++++++++++++++++++++++
> >
> > Does this split make sense? Combining 1 and 2 might be acceptable to
> > those subsystem maintainers...
>
> You read my mind here after I sent this, this is exactly what I was thinking.
>
> When I am done do I publish this to kernel mainline, here, or elsewhere?
Both here and lkml would make sense. Find the respective maintainers
using scripts/get_maintainer.pl and Cc: them.
> Bill
- RGB
--
Richard Guy Briggs <rbriggs at redhat.com>
Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, Red Hat
Remote, Ottawa, Canada
Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545
More information about the Linux-audit
mailing list