Messages in this thread | | | Date | Thu, 15 Jul 2010 11:18:03 -0400 | Subject | Re: [PATCH 02/13] AppArmor: basic auditing infrastructure. | From | Eric Paris <> |
| |
On Wed, Jul 14, 2010 at 8:43 PM, John Johansen <john.johansen@canonical.com> wrote: > Update lsm_audit for AppArmor specific data, and add the core routines for > AppArmor uses for auditing. > > Signed-off-by: John Johansen <john.johansen@canonical.com>
> + * Currently AppArmor auditing is fed straight into the audit framework. > + * > + * TODO: > + * convert to LSM audit
TODO?
> + if (sa->aad.profile) { > + struct aa_profile *profile = sa->aad.profile; > + pid_t pid; > + rcu_read_lock(); > + pid = tsk->real_parent->pid; > + rcu_read_unlock(); > + audit_log_format(ab, " parent=%d", pid); > + audit_log_format(ab, " profile="); > + if (profile->ns != root_ns) { > + audit_log_format(ab, ":"); > + audit_log_untrustedstring(ab, profile->ns->base.hname); > + audit_log_format(ab, "://"); > + } > + audit_log_untrustedstring(ab, profile->base.hname); > + }
what does this message look like? I don't think it fits the nice key=value rules of the audit system.... Are you sure this is what you want?
> +#define COMMON_AUDIT_DATA_INIT_NONE(_d) \ > + do { \ > + memset((_d), 0, sizeof(struct common_audit_data)); \ > + (_d)->type = LSM_AUDIT_DATA_NONE; \ > + } while (0) > + > +#endif /* __AA_AUDIT_H */
Why are you redefining this? You should just use COMMON_AUDIT_DATA_INIT(sa, NONE); -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |