Re: [PATCH V2] audit: log 32-bit socketcalls

2017-01-17 Thread Paul Moore
On Mon, Jan 16, 2017 at 10:53 PM, Richard Guy Briggs wrote: > On 2017-01-16 15:04, Paul Moore wrote: >> On Fri, Jan 13, 2017 at 9:42 AM, Eric Paris wrote: >> > On Fri, 2017-01-13 at 04:51 -0500, Richard Guy Briggs wrote: >> >> diff --git a/include/linux/audit.h b/include/linux/audit.h >> >> index

Re: [PATCH V2] audit: log 32-bit socketcalls

2017-01-16 Thread Richard Guy Briggs
On 2017-01-16 13:27, David Miller wrote: > From: Richard Guy Briggs > Date: Fri, 13 Jan 2017 04:51:48 -0500 > > > diff --git a/include/linux/audit.h b/include/linux/audit.h > > index 9d4443f..43d8003 100644 > > --- a/include/linux/audit.h > > +++ b/include/linux/audit.h > > @@ -387,6 +387,18 @@ s

Re: [PATCH V2] audit: log 32-bit socketcalls

2017-01-16 Thread Richard Guy Briggs
On 2017-01-16 15:04, Paul Moore wrote: > On Fri, Jan 13, 2017 at 9:42 AM, Eric Paris wrote: > > On Fri, 2017-01-13 at 04:51 -0500, Richard Guy Briggs wrote: > >> diff --git a/include/linux/audit.h b/include/linux/audit.h > >> index 9d4443f..43d8003 100644 > >> --- a/include/linux/audit.h > >> +++

Re: [PATCH V2] audit: log 32-bit socketcalls

2017-01-16 Thread David Miller
From: Paul Moore Date: Mon, 16 Jan 2017 15:38:33 -0500 > David, assuming Richard makes your requested changes, any objection if > I merge this via the audit tree instead of the netdev tree? It's a > bit easier for us from a testing perspective this way ... No objection.

Re: [PATCH V2] audit: log 32-bit socketcalls

2017-01-16 Thread Paul Moore
On Mon, Jan 16, 2017 at 1:27 PM, David Miller wrote: > From: Richard Guy Briggs > Date: Fri, 13 Jan 2017 04:51:48 -0500 > >> diff --git a/include/linux/audit.h b/include/linux/audit.h >> index 9d4443f..43d8003 100644 >> --- a/include/linux/audit.h >> +++ b/include/linux/audit.h >> @@ -387,6 +387,

Re: [PATCH V2] audit: log 32-bit socketcalls

2017-01-16 Thread Paul Moore
On Fri, Jan 13, 2017 at 9:42 AM, Eric Paris wrote: > On Fri, 2017-01-13 at 04:51 -0500, Richard Guy Briggs wrote: >> diff --git a/include/linux/audit.h b/include/linux/audit.h >> index 9d4443f..43d8003 100644 >> --- a/include/linux/audit.h >> +++ b/include/linux/audit.h >> @@ -387,6 +387,18 @@ sta

Re: [PATCH V2] audit: log 32-bit socketcalls

2017-01-16 Thread David Miller
From: Richard Guy Briggs Date: Fri, 13 Jan 2017 04:51:48 -0500 > diff --git a/include/linux/audit.h b/include/linux/audit.h > index 9d4443f..43d8003 100644 > --- a/include/linux/audit.h > +++ b/include/linux/audit.h > @@ -387,6 +387,18 @@ static inline int audit_socketcall(int nargs, unsigned >

Re: [PATCH V2] audit: log 32-bit socketcalls

2017-01-13 Thread Richard Guy Briggs
On 2017-01-13 10:18, Eric Paris wrote: > On Fri, 2017-01-13 at 10:06 -0500, Richard Guy Briggs wrote: > > On 2017-01-13 09:42, Eric Paris wrote: > > > On Fri, 2017-01-13 at 04:51 -0500, Richard Guy Briggs wrote: > > > > > > diff --git a/include/linux/audit.h b/include/linux/audit.h > > > > index

Re: [PATCH V2] audit: log 32-bit socketcalls

2017-01-13 Thread Eric Paris
On Fri, 2017-01-13 at 10:06 -0500, Richard Guy Briggs wrote: > On 2017-01-13 09:42, Eric Paris wrote: > > On Fri, 2017-01-13 at 04:51 -0500, Richard Guy Briggs wrote: > > > diff --git a/include/linux/audit.h b/include/linux/audit.h > > > index 9d4443f..43d8003 100644 > > > --- a/include/linux/aud

Re: [PATCH V2] audit: log 32-bit socketcalls

2017-01-13 Thread Richard Guy Briggs
On 2017-01-13 09:42, Eric Paris wrote: > On Fri, 2017-01-13 at 04:51 -0500, Richard Guy Briggs wrote: > > 32-bit socketcalls were not being logged by audit on x86_64 systems. > > Log them.  This is basically a duplicate of the call from > > net/socket.c:sys_socketcall(), but it addresses the impeda

Re: [PATCH V2] audit: log 32-bit socketcalls

2017-01-13 Thread Eric Paris
On Fri, 2017-01-13 at 04:51 -0500, Richard Guy Briggs wrote: > 32-bit socketcalls were not being logged by audit on x86_64 systems. > Log them.  This is basically a duplicate of the call from > net/socket.c:sys_socketcall(), but it addresses the impedance > mismatch > between 32-bit userspace proce

[PATCH V2] audit: log 32-bit socketcalls

2017-01-13 Thread Richard Guy Briggs
32-bit socketcalls were not being logged by audit on x86_64 systems. Log them. This is basically a duplicate of the call from net/socket.c:sys_socketcall(), but it addresses the impedance mismatch between 32-bit userspace process and 64-bit kernel audit. See: https://github.com/linux-audit/audit-