[PATCH] audit: don't attempt to lookup PIDs when changing PID filtering audit rules
Richard Guy Briggs
rgb at redhat.com
Mon Dec 15 19:33:36 UTC 2014
On 14/12/15, Paul Moore wrote:
> On Monday, December 15, 2014 01:51:52 PM Eric Paris wrote:
> > On Mon, 2014-12-15 at 13:50 -0500, Richard Guy Briggs wrote:
> > > On 14/12/15, Eric Paris wrote:
> > > > Lets say I and in the non-init pid namespace.
> > > >
> > > > I run audictl -a exit,always -S all -F pid=1
> > >
> > > That's easy (for now). Line 675 of kernel/audit.c in audit_netlink_ok()
> > >
> > > called from audit_receive_msg() will prevent that with:
> > > if ((task_active_pid_ns(current) != &init_pid_ns))
> > >
> > > return -EPERM;
> > >
> > > > Is the audit system going to show records for what I think is pid=1 or
> > > > what the initial pid namespace thinks is pid=1 ?
> >
> > ACK from me then.
>
> Okay, thanks. Anybody else want to jump on the Ack/Review bandwagon?
Guess I should have added some text about that... Add whichever you
feel is most appropriate (Ack/Review/Signed...)
> paul moore
- RGB
--
Richard Guy Briggs <rbriggs at redhat.com>
Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, Red Hat
Remote, Ottawa, Canada
Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545
More information about the Linux-audit
mailing list