Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756057AbcJTT1l (ORCPT ); Thu, 20 Oct 2016 15:27:41 -0400 Received: from mail-qk0-f171.google.com ([209.85.220.171]:36696 "EHLO mail-qk0-f171.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752652AbcJTT1i (ORCPT ); Thu, 20 Oct 2016 15:27:38 -0400 From: Paul Moore To: Richard Guy Briggs Cc: linux-audit@redhat.com, linux-kernel@vger.kernel.org, sgrubb@redhat.com, eparis@redhat.com Subject: Re: [PATCH V3 0/3] Add support for session ID user filtering Date: Thu, 20 Oct 2016 15:27:36 -0400 Message-ID: <1817842.78IB8nV8t8@sifl> Organization: Red Hat User-Agent: KMail/4.14.10 (Linux/4.7.4-gentoo; KDE/4.14.24; x86_64; ; ) In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1778 Lines: 44 On Thursday, August 18, 2016 01:43:12 PM Richard Guy Briggs wrote: > https://github.com/linux-audit/audit-kernel/wiki/RFE-Session-ID-User-Filter > RFE Session ID User Filter > > https://github.com/linux-audit/audit-kernel/issues/4 > RFE: add a session ID filter to the kernel's user filter > > See also the set of userspace suport patches: > Add support for sessionid user filters, sessionid_set and loginuid_set > https://www.redhat.com/archives/linux-audit/2016-August/msg00005.html > (userspace update expected to be posted 2016-08-18) > and the test case: > https://github.com/rgbriggs/audit-testsuite/tree/ghak4-test-for-sessionID-u > ser-filter > > This third patch is expected to have a merge conflict with: > "audit: add exclude filter extension to feature bitmap" > posted on 2016-08-18. > > Richard Guy Briggs (3): > audit: add support for session ID user filter > audit: add AUDIT_SESSIONID_SET support > audit: add sessionid filter extension to feature bitmap > > include/linux/audit.h | 10 ++++++++++ > include/uapi/linux/audit.h | 6 +++++- > kernel/auditfilter.c | 5 +++++ > kernel/auditsc.c | 6 ++++++ > 4 files changed, 26 insertions(+), 1 deletions(-) In light of our current decision to drop the session ID "set" filter, I'm taking another look at these patches and Richard's comment to simply drop patch 2/3 and apply 1/3 and 3/3. Richard, as I mentioned earlier, perhaps not clearly enough, I think we should put a check in audit_set_loginuid() to skip the (int)-1 value from appearing in session_id during normal operation. In other words, roll/reset the value in session_id one value early so we don't run into problems with the (int)-1 unset sentinel value. -- paul moore security @ redhat