Received: by 2002:ad5:474a:0:0:0:0:0 with SMTP id i10csp2370644imu; Tue, 6 Nov 2018 13:26:44 -0800 (PST) X-Google-Smtp-Source: AJdET5fWi10mdaFLsP5KicLx5fEOj+HTsOBAyuCgI9BKwtjU4YYk1ZWsutVxwQLXnkFnyPic0itB X-Received: by 2002:a63:30c8:: with SMTP id w191-v6mr24753579pgw.447.1541539604839; Tue, 06 Nov 2018 13:26:44 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1541539604; cv=none; d=google.com; s=arc-20160816; b=qQtjNHcC2hQKVZyw08L9gmxs6BdcCSprCXyLJUce0jT4f5Yb+5Vv0QR5t7408CbWpd n+8z4aawePmApwowxwZmrE7XcE2Z3tw9PR2aT7bGarIsZ/nOpRdPFZ6Kd2G7f1azCxJ/ CgVdvyrZxdd+bakcVzaZE6dRlqoDanc9Hyu2QtbPTz4lDrfBrhJQepoM9TtqQIgiQi8h AEmlII3oMo0Ja2RTnpRtR8J3A6m8uOR8wRMeDegkciQ5amsZ03dsY08mb9RU9xbGTrTw vl4IzOee5KqZueHf1uNwgEaCxpfrHvzsZdP4vbqjSbPnomKNprtjb/BkR/Sggq7JUQoP A47Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:dkim-signature; bh=6Fuve3pXzZ2+HQbAzrYsq43N10dVgg4dVpwsKvp6UQw=; b=dvJXgMvvSvJZr65INmknRL/PKncHCLwI7vAIc8htH31F/Q5MbcrRfFdHYiUf7wTX/o YbUvJJyXnulqk/VWIirbnjf49VLRXI7+klp5WrB3TmgBC2Z+psWH/J48wsiYKjW0R85h mDyD0WY3P22SzEug6OQ87dnbk5qMRVBba60xdXq3wAX5x8l/9gT2nqCGrDQEZ8YtmEPE wnpyA2HL98Z+6AosA1sJCMldYwftEjUAEhk2T1N8PJDbv8s76H5+0a76nGeX4PqvbtBz TLU1fsLm681z0nbLAYNtcge9+bpRdB/fgquXKIZ3W48QbXl0RtfXkLtvecqbc9TypOta 8TbQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@gmail.com header.s=20161025 header.b=euAJIe9M; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id y3-v6si20941197pfe.42.2018.11.06.13.26.28; Tue, 06 Nov 2018 13:26:44 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@gmail.com header.s=20161025 header.b=euAJIe9M; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726349AbeKGGwp (ORCPT + 99 others); Wed, 7 Nov 2018 01:52:45 -0500 Received: from mail-ot1-f67.google.com ([209.85.210.67]:45949 "EHLO mail-ot1-f67.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725951AbeKGGwp (ORCPT ); Wed, 7 Nov 2018 01:52:45 -0500 Received: by mail-ot1-f67.google.com with SMTP id g10so12851466otl.12 for ; Tue, 06 Nov 2018 13:25:32 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=6Fuve3pXzZ2+HQbAzrYsq43N10dVgg4dVpwsKvp6UQw=; b=euAJIe9MTPuRD+2ksa5bVtfQuxADI2Z26U8PWtLUrLf2U/JHm5kW+XBbn1oCo7aw8I ECiyQmNeY+xy3keAQlz0lzh1mAvZl92pshsQ1X5UJszj0uz+hphkpP1Tr63lGguW5cYP VdmzIKFg4X58fQI+icUh1eYjnSwZ3K4zGbtkcIQz56NlffDyProJW1X7of0L8nCmn3oY hPC0b2bYgHp8DnIHLdpfiTZecvT8Z/MWbCsmjFsG9c20ZxrCZSstlG2+6Jak4Xz1X/aH NPwTKPuajXemwQ2Y14Z8ORi46Mxgpoe3/E2voYlbp+hR9XjSRxpiReZLLArc+dBYkjk2 a6HQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=6Fuve3pXzZ2+HQbAzrYsq43N10dVgg4dVpwsKvp6UQw=; b=PGJgJ0/zktMaOdtVq1guoiEwshObqGGfoy1XEajG8RIucqMaeDcsgpiRkMDUN8k7GV +XSPHpeT/TueVLiTyFDLH/W/7LMruCxeHZPejHM9QXhhBSyWzJseeIZrAf8KVIGzDjCv gjNhEfPNLw/yvB54SDdXknVqt0W6qjARjj1wmsJI/u2r5svNF95bK6r9T3TKwz/bta2g w5KCDH+/fgjAd3KF45a9AkFNhqnJwSwWqscjccXEM/x60ohxaXT3+qt4LMEIvzmivNbf RHEiVjfrjUs3OIj7jioqQ3ZypNqwatn8373tIhU4W3sQWfyNqbgxNb5QgvsRCRe2D4KJ RAQA== X-Gm-Message-State: AGRZ1gLRQ+U3K2pBg2ZB5cEPdEaRj9l7Nl7L5HC6G1WQCOA1oq6B7T2w cyZutPbYSJ/B146c5GUCbTDdtd5+HaOT9VK3lo8= X-Received: by 2002:a9d:dc3:: with SMTP id 61mr8355261ots.345.1541539532360; Tue, 06 Nov 2018 13:25:32 -0800 (PST) MIME-Version: 1.0 References: <20181029104854.17432-1-david.abdurachmanov@gmail.com> In-Reply-To: From: David Abdurachmanov Date: Tue, 6 Nov 2018 22:25:20 +0100 Message-ID: Subject: Re: [PATCH 0/2] riscv: add audit support To: Paul Moore Cc: Palmer Dabbelt , aou@eecs.berkeley.edu, linux-riscv@lists.infradead.org, linux-kernel@vger.kernel.org, linux-audit@redhat.com Content-Type: text/plain; charset="UTF-8" Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, Nov 6, 2018 at 9:06 PM Paul Moore wrote: > > On Mon, Oct 29, 2018 at 6:49 AM David Abdurachmanov > wrote: > > This patchset adds system call audit support on riscv (riscv32 & > > riscv64). > > > > The pachset was prepared on top of v4.19 tag. > > > > audit-userspace changes were submitted. See: > > https://github.com/linux-audit/audit-userspace/pull/73 > > > > Tested the following manually: > > - auditctl (checked several different example rules from internet) > > - aulast > > - aulastlog > > - ausearch > > - ausyscall > > - aureport > > - autrace (compared some syscalls to strace: order and return > > value/input arguments seem to be correct) > > - /proc/self/loginuid (required by DNF [package manager]) > > > > I looked into audit-testsuite and with some adjustments results are: > > > > Failed 4/14 test programs. 19/88 subtests failed. > > I realize that the test suite failures are likely not due to your > code, but rather shortcomings in the test suite itself, but I think it > is important to resolve these problems before we commit the kernel > changes. > > You mention Fedora 29/RISCV below, is that the distro you are using > for testing? Also, are you using a stock kernel config from the > distro or your own? > > > The failing tests were due to missing CONFIG_IP_NF_MANGLE ... > > Assuming a general purpose like Fedora, that seems like an odd > omission. Any chance you can rebuild your kernel with the mangle > table? When we build Fedora, the kernel is not built in a standard way. It's only build statically and contains minimal setup. We also don't do loadable kernel modules, because there wasn't support for it months ago. It's not tested yet by us. I did rebuild with CONFIG_IP_NF_MANGLE, but I think, there was more stuff missing. Have to look again. I am experimenting on building kernel in normal Fedora way, but there are some issues right now. It also takes 12-24 hours for a single attempt. > > > ... 'id -Z' not printing categories (don't know why) ... > > Are you seeing the MLS/MCS sensitivity level, s0, or are you not > seeing any of the MLS/MCS fields? I boot my VM "selinux=1 enforcing=0". [root@fedora-riscv ~]# semanage login -l Login Name SELinux User MLS/MCS Range Service __default__ unconfined_u s0-s0:c0.c1023 * root unconfined_u s0-s0:c0.c1023 * [root@fedora-riscv ~]# id -Z unconfined_u:unconfined_r:unconfined_t:s0 > > > ... not having loadable kernel module support enablled ... > > Much like the netfilter config, any chance you can enable this in your kernel? Experimenting, not sure if it works yet. > > > ... and syscall_socketcall not being relevant for new arches. > > We will probably need to make that ABI dependent in the test suite. > > > audit-testsuite with adjustments: > > https://github.com/davidlt/audit-testsuite/tree/riscv64 > > > > Depends on: > > [PATCH 1/2] Move EM_RISCV into elf-em.h > > http://lists.infradead.org/pipermail/linux-riscv/2018-October/001885.html > > > > This should solve DNF issues in Fedora 29/RISCV. > > -- > paul moore > www.paul-moore.com