Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754640AbcJUGrE (ORCPT ); Fri, 21 Oct 2016 02:47:04 -0400 Received: from mx1.redhat.com ([209.132.183.28]:60602 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754086AbcJUGrC (ORCPT ); Fri, 21 Oct 2016 02:47:02 -0400 Date: Fri, 21 Oct 2016 02:46:58 -0400 From: Richard Guy Briggs To: Paul Moore Cc: linux-audit@redhat.com, linux-kernel@vger.kernel.org, sgrubb@redhat.com, eparis@redhat.com Subject: Re: [PATCH V3 0/3] Add support for session ID user filtering Message-ID: <20161021064658.GR23701@madcap2.tricolour.ca> References: <1817842.78IB8nV8t8@sifl> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1817842.78IB8nV8t8@sifl> User-Agent: Mutt/1.5.21 (2010-09-15) X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.39]); Fri, 21 Oct 2016 06:47:02 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2279 Lines: 55 On 2016-10-20 15:27, Paul Moore wrote: > On Thursday, August 18, 2016 01:43:12 PM Richard Guy Briggs wrote: > > https://github.com/linux-audit/audit-kernel/wiki/RFE-Session-ID-User-Filter > > RFE Session ID User Filter > > > > https://github.com/linux-audit/audit-kernel/issues/4 > > RFE: add a session ID filter to the kernel's user filter > > > > See also the set of userspace suport patches: > > Add support for sessionid user filters, sessionid_set and loginuid_set > > https://www.redhat.com/archives/linux-audit/2016-August/msg00005.html > > (userspace update expected to be posted 2016-08-18) > > and the test case: > > https://github.com/rgbriggs/audit-testsuite/tree/ghak4-test-for-sessionID-u > > ser-filter > > > > This third patch is expected to have a merge conflict with: > > "audit: add exclude filter extension to feature bitmap" > > posted on 2016-08-18. > > > > Richard Guy Briggs (3): > > audit: add support for session ID user filter > > audit: add AUDIT_SESSIONID_SET support > > audit: add sessionid filter extension to feature bitmap > > > > include/linux/audit.h | 10 ++++++++++ > > include/uapi/linux/audit.h | 6 +++++- > > kernel/auditfilter.c | 5 +++++ > > kernel/auditsc.c | 6 ++++++ > > 4 files changed, 26 insertions(+), 1 deletions(-) > > In light of our current decision to drop the session ID "set" filter, I'm > taking another look at these patches and Richard's comment to simply drop > patch 2/3 and apply 1/3 and 3/3. > > Richard, as I mentioned earlier, perhaps not clearly enough, I think we should > put a check in audit_set_loginuid() to skip the (int)-1 value from appearing > in session_id during normal operation. In other words, roll/reset the value > in session_id one value early so we don't run into problems with the (int)-1 > unset sentinel value. I noted your comment earlier and I agree skipping the sentinel is required, but if we are rolling this counter, we have bigger issues unless there is a way to determine if a sessionID value is still in use by at least one task. > paul moore - RGB -- Richard Guy Briggs Kernel Security Engineering, Base Operating Systems, Red Hat Remote, Ottawa, Canada Voice: +1.647.777.2635, Internal: (81) 32635