Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1758061AbZCTIxr (ORCPT ); Fri, 20 Mar 2009 04:53:47 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1757926AbZCTIxd (ORCPT ); Fri, 20 Mar 2009 04:53:33 -0400 Received: from mx1.redhat.com ([66.187.233.31]:42046 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1757971AbZCTIxb (ORCPT ); Fri, 20 Mar 2009 04:53:31 -0400 Date: Fri, 20 Mar 2009 04:53:27 -0400 (EDT) From: Miloslav Trmac To: Paul Moore Cc: viro , Eric Paris , linux-kernel , linux-audit@redhat.com Message-ID: <1666981128.1772561237539207343.JavaMail.root@zmail07.collab.prod.int.phx2.redhat.com> In-Reply-To: <1446383553.1772511237538977759.JavaMail.root@zmail07.collab.prod.int.phx2.redhat.com> Subject: Re: [PATCH] Add SELinux context and TTY name to AUDIT_TTY records MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-Originating-IP: [10.5.5.72] Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 870 Lines: 20 Paul, Thanks for your review. ----- "Paul Moore" wrote: > There are several audit experts which should review this code but two > things > jumped out at me when glancing at your patch: > > 1. SELinux SIDs should not be recorded Almost all code that logs SELinux contexts in kernel/audit* does the same thing as this patch, falling back to a SID if it can't be converted to a string. > 2. From a SELinux/security point of view ttys are considered objects > and their labels/contexts should be recorded with "obj=" not > "subj=" The patch logs the context of the process, not of the TTY. Mirek -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/