[PATCH V3] audit: normalize NETFILTER_PKT

[Paul Moore]

On Fri, Mar 3, 2017 at 8:22 AM, Florian Westphal <fw at strlen.de> wrote:
> Paul Moore <paul at paul-moore.com> wrote:
>> On Fri, Mar 3, 2017 at 7:45 AM, Florian Westphal <fw at strlen.de> wrote:
>> > Richard Guy Briggs <rgb at redhat.com> wrote:
>> >> > Perhaps I'm missing something here, but let me ask again, how does
>> >> > userspace distinguish between an unset nfmark and a nfmark of
>> >> > 0xffffffff?
>> >>
>> >> It can't.
>> >
>> > It can if you log it as 0, as I asked in patch 1 review.
>> >
>> > (You wouldn't log sk uid of 0 as -1 either, would you?)
>>
>> I want to see the code able to handle the full range of nfmark values
>> as well as the unset case; if that means we need to tweak userspace a
>> bit, please work with Steve on that.
>
> There is no 'unset nfmark'.  Its just a 32bit integer.

Yes, my apologies, this thread has dragged on so long I muddled the
details in my mind ... here is what I'm trying to get at, Richard's
latest patch (unless I've missed one in my inbox) has the following
line:

  audit_log_format(ab, "mark=%#x", skb->mark ?: -1);

... which I believe to be incorrect.  I was trying to lead Richard
along to that same realization, but it would appear I'm not having
much success, so to put it bluntly, here is what I want that line to
look like:

  audit_log_format(ab, "mark=%#x", skb->mark);

-- 
paul moore
www.paul-moore.com