Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   Chris Mason <clm@fb.com>
To:     Steve Grubb <sgrubb@redhat.com>
CC:     "linux-audit@redhat.com" <linux-audit@redhat.com>,
        Paul Moore <paul@paul-moore.com>,
        Dave Jones <davej@codemonkey.org.uk>,
        Kyle McMartin <jkkm@fb.com>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH] audit: set context->dummy even when audit is off
Thread-Topic: [PATCH] audit: set context->dummy even when audit is off
Thread-Index: AQHVkAncrhonQVVxy06vYxt2pY3gVKd1ZVQAgACm2QCAAFHHAIAAG16A
Date:   Fri, 1 Nov 2019 15:55:02 +0000
Message-ID: <EE4EBB7B-B3CA-4CFC-9B14-843ADDB9F2EA@fb.com>
References: <CAHC9VhTyz7fd+iQaymVXUGFe3ZA5Z_WkJeY_snDYiZ9GP6gCOA@mail.gmail.com>
 <CAHC9VhRwRSGa5JSL0=cXxG-oOg9jUve9OEYyTCqTxzr=aMdGxg@mail.gmail.com>
 <B63048C4-3158-453B-859A-C5574AACDC36@fb.com> <3063279.ZKBa9cPvsK@x2>
In-Reply-To: <3063279.ZKBa9cPvsK@x2>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-messagesentrepresentingtype: 1
x-originating-ip: [2620:10d:c091:480::5594]
x-ms-publictraffictype: Email
x-ms-office365-filtering-correlation-id: b8c78441-4227-491f-76e0-08d75ee3daff
x-ms-traffictypediagnostic: SN6PR15MB2463:
x-ms-exchange-transport-forked: True
x-microsoft-antispam-prvs: <SN6PR15MB2463B2C54DBD4D6E974196B7D3620@SN6PR15MB2463.namprd15.prod.outlook.com>
x-ms-oob-tlc-oobclassifiers: OLM:4125;
x-forefront-prvs: 020877E0CB
x-forefront-antispam-report: SFV:NSPM;SFS:(10019020)(376002)(136003)(39860400002)(396003)(366004)(346002)(189003)(199004)(7736002)(5660300002)(8676002)(8936002)(2906002)(46003)(2616005)(446003)(476003)(11346002)(6512007)(305945005)(256004)(81156014)(64756008)(66476007)(486006)(66446008)(81166006)(66556008)(386003)(186003)(6506007)(53546011)(102836004)(6116002)(6916009)(52116002)(76176011)(50226002)(66946007)(316002)(6246003)(14454004)(71190400001)(6436002)(36756003)(25786009)(478600001)(33656002)(54906003)(4326008)(99286004)(71200400001)(6486002)(86362001)(229853002);DIR:OUT;SFP:1102;SCL:1;SRVR:SN6PR15MB2463;H:SN6PR15MB2446.namprd15.prod.outlook.com;FPR:;SPF:None;LANG:en;PTR:InfoNoRecords;MX:1;A:1;
received-spf: None (protection.outlook.com: fb.com does not designate
 permitted sender hosts)
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info: T0kOr1XP8OlxAnOva0zpvB+6rnQkKof5JlS2thiuRE782C4JUwafGXY8csDBScAsnXZDPjJQ09FRW4s4nniD51vxa/s9sbxH6UMAWHvTUGHPXGQzF6jGDQ6CE/soUdFi/YJ7DoHWoAm488sGl7AQ/hNXffkU9PH9ut2Do05sWyaeibvE6b3nXEeN+2hHPyrGyBQpxoLTQAqT3sAomBffD5YF1BPm+4TKfLEv7zIDXzCZDNseVc9mkxyyKK+OgGUasbfZuk//h0lYtmjV1j/FUfk9LTEgmUZKjK5MKGWQpXDvIT1k4l+bulU8QxVNATY5rHrBbuaWjSmjAMMLDXjGedzFFIZiuTCXS1jz3oKDFrkeVIyVUQOypxndcFfA3GiLzaIaV2pslVBYT067AcBs91cDuymkjyL98AW5pcddBTnySnYT5j7Q0SemK1ERwJWx
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: b8c78441-4227-491f-76e0-08d75ee3daff
X-MS-Exchange-CrossTenant-originalarrivaltime: 01 Nov 2019 15:55:02.2725
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 8ae927fe-1255-47a7-a2af-5f3a069daaa2
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: hxU1jac83L3MTeqqHAz5kv6KfsBByAFdyyU2Pax5AkudAk3wdevIOUMGNzrwN1hd
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN6PR15MB2463
X-OriginatorOrg: fb.com
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.95,1.0.8
 definitions=2019-10-31_08:2019-10-30,2019-10-31 signatures=0
X-Proofpoint-Spam-Details: rule=fb_default_notspam policy=fb_default score=0 mlxlogscore=999
 impostorscore=0 malwarescore=0 adultscore=0 clxscore=1011 mlxscore=0
 priorityscore=1501 suspectscore=0 bulkscore=0 lowpriorityscore=0
 phishscore=0 spamscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-1908290000 definitions=main-1911010024
X-FB-Internal: deliver
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On 1 Nov 2019, at 10:16, Steve Grubb wrote:

> On Friday, November 1, 2019 9:24:17 AM EDT Chris Mason wrote:
>> On 31 Oct 2019, at 19:27, Paul Moore wrote:
>>> On Thu, Oct 31, 2019 at 12:40 PM Chris Mason <clm@fb.com> wrote:
>>> [ ... ]
>>> Hi Chris,
>>>
>>> This is a rather hasty email as I'm at a conference right now, but I
>>> wanted to convey that I'm not opposed to making sure that the NTP
>>> records obey the audit configuration (that was the original intent
>>> after all), I think it is just that we are all a little confused as=20
>>> to
>>> why you are seeing the NTP records *and*only* the NTP records.
>>
>> This part is harder to nail down because there's a window during boot
>> where journald has enabled audit but chef hasn't yet run in and=20
>> turned
>> it off, so we get a lot of logs early and then mostly ntp after that.
>
> This is the root of the problem. Journald should never turn on audit=20
> since it
> has no idea if auditd even has rules to load. What if the end user=20
> does not
> want auditing? By blindly enabling audit without knowing if its=20
> wanted, it
> causes a system performance hit even with no rules loaded. It would be=20
> best
> if journald leaves audit alone. If it wants to listen on the multicast
> socket, so be it. It should just listen and not try to alter the=20
> system.
>
> Back to ntp, it sounds like the ntp record needs to check for=20
> audit_enabled
> rather than the dummy context.

I'm not against sprinkling more audit_enabled checks, but we'd have to=20
change audit_inode() and a bunch of the other callers of=20
audit_dummy_context() as well.

-chris