LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
From: Paul Moore <paul.moore@hp.com>
To: "Ahmed S. Darwish" <darwish.07@gmail.com>
Cc: Chris Wright <chrisw@sous-sol.org>,
	Stephen Smalley <sds@tycho.nsa.gov>,
	James Morris <jmorris@namei.org>,
	Eric Paris <eparis@parisplace.org>,
	Casey Schaufler <casey@schaufler-ca.com>,
	David Woodhouse <dwmw2@infradead.org>,
	Andrew Morton <akpm@linux-foundation.org>,
	LKML <linux-kernel@vger.kernel.org>,
	Audit-ML <linux-audit@redhat.com>,
	LSM-ML <linux-security-module@vger.kernel.org>
Subject: Re: [PATCH 7/9] Audit: internally use the new LSM audit hooks
Date: Mon, 3 Mar 2008 18:51:41 -0500	[thread overview]
Message-ID: <200803031851.41978.paul.moore@hp.com> (raw)
In-Reply-To: <20080301200111.GH19636@ubuntu>

On Saturday 01 March 2008 3:01:11 pm Ahmed S. Darwish wrote:
> Convert Audit to use the new LSM Audit hooks instead of
> the exported SELinux interface.
>
> Basically, use:
> security_audit_rule_init
> secuirty_audit_rule_free
> security_audit_rule_known
> security_audit_rule_match
>
> instad of (respectively) :
> selinux_audit_rule_init
> selinux_audit_rule_free
> audit_rule_has_selinux
> selinux_audit_rule_match
>
> Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
> Signed-off-by: Ahmed S. Darwish <darwish.07@gmail.com>
> ---
>
>  audit.c       |    7 ------
>  auditfilter.c |   61
> ++++++++++++++++------------------------------------------ auditsc.c 
>    |    9 +++-----
>  3 files changed, 22 insertions(+), 55 deletions(-)

For some reason some of your patches are not coming through with correct 
diffstats (notice the lack of a path relative to the kernel base?).  
Don't worry too much about it as it's not grounds to reject the patch 
(at least in my mind) but it's worth looking into on your end for the 
next time you submit patches.

> Andrew, please atomically merge patch #7 and patch #8. Although
> a system with patch7 and without patch8 will be compiled fine,
> the SELinux Audit hooks are not set up yet. This means below
> audit hooks will point to the dummy hooks instead of SELinux
> ones even if SELinux is enabled.
>
> I could not setup the SELinux hooks first cause they have
> the same name of the old exported SELinux interface with a
> difference of one parameter.

In cases like this where you need patches applied atomically to ensure 
correct operation you can always combine the two patches into one 
(assuming they are still small enough to be posted, which shouldn't be 
a problem here).  Small patches are nice and easy to review, but that 
doesn't mean you have to break everything up if it is awkward.

I've looked over patches #7, #8, and #9 and they look okay to me, but 
I'm not tagging them 'Reviewed-by' because they go beyond areas of the 
kernel that I feel comfortable reviewing at this point.  Rest assured 
there are other on the To/CC line that can help you out (I see James 
Morris already Ack'd your entire patch set).

Thanks for all your work on this, it's a nice improvement.

-- 
paul moore
linux security @ hp

  parent reply	other threads:[~2008-03-03 23:52 UTC|newest]

Thread overview: 31+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2008-03-01 19:47 [PATCH-v2 -mm 0/9] LSM-neutral Audit (SELinux audit separation) Ahmed S. Darwish
2008-03-01 19:51 ` [PATCH 1/9] LSM: Introduce inode_getsecid and ipc_getsecid hooks Ahmed S. Darwish
2008-03-03 21:18   ` James Morris
2008-03-03 23:26   ` Paul Moore
2008-03-01 19:52 ` [PATCH 2/9] SELinux: setup new inode/ipc getsecid hooks Ahmed S. Darwish
2008-03-03 21:19   ` James Morris
2008-03-03 23:25   ` Paul Moore
2008-03-01 19:54 ` [PATCH 3/9] Audit: use new LSM hooks instead of SELinux exports Ahmed S. Darwish
2008-03-03 21:19   ` James Morris
2008-03-03 23:31   ` Paul Moore
2008-03-01 19:56 ` [PATCH 4/9] Netlink: Use generic LSM hook Ahmed S. Darwish
2008-03-03 21:19   ` James Morris
2008-03-03 21:30     ` David Miller
2008-03-03 23:33   ` Paul Moore
2008-03-01 19:58 ` [PATCH 5/9] SELinux: remove redundant exports Ahmed S. Darwish
2008-03-03 21:20   ` James Morris
2008-03-03 23:41   ` Paul Moore
2008-03-01 20:00 ` [PATCH 6/9] LSM/Audit: Introduce generic Audit LSM hooks Ahmed S. Darwish
2008-03-03 21:20   ` James Morris
2008-03-03 23:36   ` Paul Moore
2008-03-01 20:01 ` [PATCH 7/9] Audit: internally use the new LSM audit hooks Ahmed S. Darwish
2008-03-03 21:20   ` James Morris
2008-03-03 23:51   ` Paul Moore [this message]
2008-03-04  3:31     ` Ahmed S. Darwish
2008-03-04  4:09       ` James Morris
2008-03-04  4:15     ` James Morris
2008-03-01 20:03 ` [PATCH 8/9] SELinux: use new audit hooks, remove redundant exports Ahmed S. Darwish
2008-03-03 21:20   ` James Morris
2008-03-01 20:05 ` [PATCH 9/9] Audit: Final renamings and cleanup Ahmed S. Darwish
2008-03-03 21:21   ` James Morris
2008-03-05  5:29 ` [PATCH-v2 -mm 0/9] LSM-neutral Audit (SELinux audit separation) James Morris

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=200803031851.41978.paul.moore@hp.com \
    --to=paul.moore@hp.com \
    --cc=akpm@linux-foundation.org \
    --cc=casey@schaufler-ca.com \
    --cc=chrisw@sous-sol.org \
    --cc=darwish.07@gmail.com \
    --cc=dwmw2@infradead.org \
    --cc=eparis@parisplace.org \
    --cc=jmorris@namei.org \
    --cc=linux-audit@redhat.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-security-module@vger.kernel.org \
    --cc=sds@tycho.nsa.gov \
    --subject='Re: [PATCH 7/9] Audit: internally use the new LSM audit hooks' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
on how to clone and mirror all data and code used for this inbox