Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   Chris Mason <clm@fb.com>
To:     Paul Moore <paul@paul-moore.com>
CC:     Eric Paris <eparis@redhat.com>,
        Dave Jones <davej@codemonkey.org.uk>,
        "linux-audit@redhat.com" <linux-audit@redhat.com>,
        Kyle McMartin <jkkm@fb.com>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH] audit: set context->dummy even when audit is off
Thread-Topic: [PATCH] audit: set context->dummy even when audit is off
Thread-Index: AQHVkAncrhonQVVxy06vYxt2pY3gVKd1ZVQAgADp5wA=
Date:   Fri, 1 Nov 2019 13:24:17 +0000
Message-ID: <B63048C4-3158-453B-859A-C5574AACDC36@fb.com>
References: <CAHC9VhTyz7fd+iQaymVXUGFe3ZA5Z_WkJeY_snDYiZ9GP6gCOA@mail.gmail.com>
 <20191031163931.1102669-1-clm@fb.com>
 <CAHC9VhRwRSGa5JSL0=cXxG-oOg9jUve9OEYyTCqTxzr=aMdGxg@mail.gmail.com>
In-Reply-To: <CAHC9VhRwRSGa5JSL0=cXxG-oOg9jUve9OEYyTCqTxzr=aMdGxg@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-messagesentrepresentingtype: 1
x-originating-ip: [2620:10d:c091:480::f277]
x-ms-publictraffictype: Email
x-ms-office365-filtering-correlation-id: 052d569e-46f3-4008-d9fd-08d75ececc2a
x-ms-traffictypediagnostic: SN6PR15MB2416:
x-ms-exchange-transport-forked: True
x-microsoft-antispam-prvs: <SN6PR15MB2416612FB068C7EBA24F046FD3620@SN6PR15MB2416.namprd15.prod.outlook.com>
x-ms-oob-tlc-oobclassifiers: OLM:10000;
x-forefront-prvs: 020877E0CB
x-forefront-antispam-report: SFV:NSPM;SFS:(10019020)(136003)(346002)(376002)(366004)(39860400002)(396003)(189003)(199004)(51914003)(52116002)(8936002)(76176011)(66446008)(71200400001)(305945005)(6436002)(66556008)(33656002)(50226002)(7736002)(8676002)(81156014)(102836004)(81166006)(64756008)(66476007)(6486002)(71190400001)(478600001)(25786009)(46003)(5660300002)(14454004)(229853002)(256004)(386003)(476003)(99286004)(6246003)(14444005)(316002)(6506007)(2616005)(6916009)(53546011)(36756003)(54906003)(4326008)(186003)(66946007)(446003)(2906002)(11346002)(486006)(86362001)(6116002)(6512007);DIR:OUT;SFP:1102;SCL:1;SRVR:SN6PR15MB2416;H:SN6PR15MB2446.namprd15.prod.outlook.com;FPR:;SPF:None;LANG:en;PTR:InfoNoRecords;MX:1;A:1;
received-spf: None (protection.outlook.com: fb.com does not designate
 permitted sender hosts)
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info: XtFpG6LdmOGnfTG7uxTYGsx70JDiRsg9OQ54e173gJU6zEGXBpDmjHRoWFyFHUNvmp4kaOdOa1M/vVnGx9b1XlgNlbwJLJ9RGVx93ByXPvTmOsJ7ZeygUViCl33sc36HR5vV4hr/TTF5GOW5YKrjYAe0uHJqnul73ORVZhN3fMlgo/uQbiXAOQEkH5n+dmEpX91XsO2SToGSAbqvIYwCSGqLQ96ne/NlxqmCmvbccUvfoadMUfUa3ydLTAyyoqv+RpiYJaH0KzelPyeNRxQ7n7uh1OrVMXhaksp+NJgqq6H86FL7us3AhrQU/kaG5HMqMQT+YRaFFfWDn3/gQTdqyz+VdNBGbOMAdhxxbHh6BZESSbVnXlov+n68VFbUnMllkUfBeksjNCbkialL5RJnOxtw4NWQiOda+UrMJvUR+s7e97mZkFLNicN/3Z6W/fDV
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: 052d569e-46f3-4008-d9fd-08d75ececc2a
X-MS-Exchange-CrossTenant-originalarrivaltime: 01 Nov 2019 13:24:17.9717
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 8ae927fe-1255-47a7-a2af-5f3a069daaa2
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: QcHSE22ZnOXuSo82ujCJVsVd6qzP5skPC9KtZWh8RsvH5FlYIqORIR1AJiOp7L+3
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN6PR15MB2416
X-OriginatorOrg: fb.com
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.95,1.0.8
 definitions=2019-11-01_04:2019-10-30,2019-11-01 signatures=0
X-Proofpoint-Spam-Details: rule=fb_default_notspam policy=fb_default score=0 bulkscore=0
 lowpriorityscore=0 spamscore=0 impostorscore=0 mlxscore=0 mlxlogscore=999
 malwarescore=0 priorityscore=1501 phishscore=0 adultscore=0 suspectscore=0
 clxscore=1015 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-1908290000 definitions=main-1911010134
X-FB-Internal: deliver
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On 31 Oct 2019, at 19:27, Paul Moore wrote:

> On Thu, Oct 31, 2019 at 12:40 PM Chris Mason <clm@fb.com> wrote:
> [ ... ]
> Hi Chris,
>
> This is a rather hasty email as I'm at a conference right now, but I
> wanted to convey that I'm not opposed to making sure that the NTP
> records obey the audit configuration (that was the original intent
> after all), I think it is just that we are all a little confused as to
> why you are seeing the NTP records *and*only* the NTP records.

This part is harder to nail down because there's a window during boot=20
where journald has enabled audit but chef hasn't yet run in and turned=20
it off, so we get a lot of logs early and then mostly ntp after that.

I feel like the answer is that most of the places that actually log=20
audit records are also checking audit_enabled.  Poking a bit with=20
cscope, we're not using most of the places that rely only on=20
audit_dummy_context().

I grabbed the last week or so of audit: lines from netconsole, and most=20
of them (73%) were type 1130 from early in the boot.  These are the ones=20
turned off when chef runs.  Another big chunk were the one time audit=20
initialized message from boot, mostly reflecting our rollout of the new=20
kernel.  After that it was ntp and couple of random things like=20
fanotify.

>
> It's been a while, but I thought we suggested Dave try running
> 'auditctl -a never,task' to see if that would solve his problem and I
> believe his answer was no, which confused me a bit as the
> audit_filter_task() call in audit_alloc() should see that rule and
> return a state of AUDIT_DISABLED which not only prevents audit_alloc()
> from allocating an audit_context (and remember if the audit_context is
> NULL then audit_dummy_context() returns true), but it also clears the
> TIF_SYSCALL_AUDIT flag (which I'm guessing you also want).
>

Thanks for the reminder on this part, I meant to test it.  Yes, auditctl=20
-a never,task does stop the messages, even without my patch applied.

-chris