Re: [PATCH v1 1/2] audit: record fanotify event regardless of presence of rules

2025-08-06 Thread Richard Guy Briggs
On 2025-05-29 20:01, Paul Moore wrote: > On Tue, May 27, 2025 at 9:10 AM Richard Guy Briggs wrote: > > On 2025-04-11 14:14, Paul Moore wrote: > > > On Mar 5, 2025 Richard Guy Briggs wrote: > > > > > > > > When no audit rules are in place, fanotify event results are > > > > unconditionally droppe

Re: [PATCH v1 1/2] audit: record fanotify event regardless of presence of rules

2025-05-29 Thread Paul Moore
On Tue, May 27, 2025 at 9:10 AM Richard Guy Briggs wrote: > On 2025-04-11 14:14, Paul Moore wrote: > > On Mar 5, 2025 Richard Guy Briggs wrote: > > > > > > When no audit rules are in place, fanotify event results are > > > unconditionally dropped due to an explicit check for the existence of > >

Re: [PATCH v1 1/2] audit: record fanotify event regardless of presence of rules

2025-05-27 Thread Richard Guy Briggs
On 2025-04-11 14:14, Paul Moore wrote: > On Mar 5, 2025 Richard Guy Briggs wrote: > > > > When no audit rules are in place, fanotify event results are > > unconditionally dropped due to an explicit check for the existence of > > any audit rules. Given this is a report from another security > >

Re: [PATCH v1 1/2] audit: record fanotify event regardless of presence of rules

2025-04-11 Thread Paul Moore
On Mar 5, 2025 Richard Guy Briggs wrote: > > When no audit rules are in place, fanotify event results are > unconditionally dropped due to an explicit check for the existence of > any audit rules. Given this is a report from another security > sub-system, allow it to be recorded regardless of t

Re: [PATCH v1 1/2] audit: record fanotify event regardless of presence of rules

2025-03-11 Thread Jan Kara
On Fri 07-03-25 14:19:38, Richard Guy Briggs wrote: > On 2025-03-07 15:52, Jan Kara wrote: > > On Thu 06-03-25 20:12:23, Richard Guy Briggs wrote: > > > On 2025-03-06 16:06, Jan Kara wrote: > > > > On Wed 05-03-25 16:33:19, Richard Guy Briggs wrote: > > > > > When no audit rules are in place, fanot

Re: [PATCH v1 1/2] audit: record fanotify event regardless of presence of rules

2025-03-07 Thread Richard Guy Briggs
On 2025-03-07 15:52, Jan Kara wrote: > On Thu 06-03-25 20:12:23, Richard Guy Briggs wrote: > > On 2025-03-06 16:06, Jan Kara wrote: > > > On Wed 05-03-25 16:33:19, Richard Guy Briggs wrote: > > > > When no audit rules are in place, fanotify event results are > > > > unconditionally dropped due to a

Re: [PATCH v1 1/2] audit: record fanotify event regardless of presence of rules

2025-03-07 Thread Jan Kara
On Thu 06-03-25 20:12:23, Richard Guy Briggs wrote: > On 2025-03-06 16:06, Jan Kara wrote: > > On Wed 05-03-25 16:33:19, Richard Guy Briggs wrote: > > > When no audit rules are in place, fanotify event results are > > > unconditionally dropped due to an explicit check for the existence of > > > any

Re: [PATCH v1 1/2] audit: record fanotify event regardless of presence of rules

2025-03-06 Thread Richard Guy Briggs
On 2025-03-06 16:06, Jan Kara wrote: > On Wed 05-03-25 16:33:19, Richard Guy Briggs wrote: > > When no audit rules are in place, fanotify event results are > > unconditionally dropped due to an explicit check for the existence of > > any audit rules. Given this is a report from another security >

Re: [PATCH v1 1/2] audit: record fanotify event regardless of presence of rules

2025-03-06 Thread Jan Kara
On Wed 05-03-25 16:33:19, Richard Guy Briggs wrote: > When no audit rules are in place, fanotify event results are > unconditionally dropped due to an explicit check for the existence of > any audit rules. Given this is a report from another security > sub-system, allow it to be recorded regardles

[PATCH v1 1/2] audit: record fanotify event regardless of presence of rules

2025-03-05 Thread Richard Guy Briggs
When no audit rules are in place, fanotify event results are unconditionally dropped due to an explicit check for the existence of any audit rules. Given this is a report from another security sub-system, allow it to be recorded regardless of the existence of any audit rules. To test, install and