Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756957AbZDFPg6 (ORCPT ); Mon, 6 Apr 2009 11:36:58 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1756399AbZDFPet (ORCPT ); Mon, 6 Apr 2009 11:34:49 -0400 Received: from mx2.redhat.com ([66.187.237.31]:51767 "EHLO mx2.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752937AbZDFPes (ORCPT ); Mon, 6 Apr 2009 11:34:48 -0400 Subject: Re: [PATCH 0/2] security/smack implement logging V2 From: Eric Paris To: Etienne Basset Cc: LSM , Casey Schaufler , linux-audit@redhat.com, Linux Kernel Mailing List , sgrubb@redhat.com, sds@tycho.nsa.gov In-Reply-To: <49D86FFA.1010507@numericable.fr> References: <49D86FFA.1010507@numericable.fr> Content-Type: text/plain Date: Mon, 06 Apr 2009 11:34:26 -0400 Message-Id: <1239032066.4009.5.camel@localhost.localdomain> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1092 Lines: 25 On Sun, 2009-04-05 at 10:46 +0200, Etienne Basset wrote: > the following 2 patches implements auditing of security events for Smack. > It tries to implement what Eric Paris suggested, and moves shareable code > to include/linux/lsm_audit.h and security/lsm_audit.c. > Smack specific logging functions are now defined in smack_access.c > type=1400 audit(1238919813.116:21): SMACK[smack_inode_getattr]: action=denied subject="FOO" object="etienne" requested=r pid=6679 comm="bash" path="/home/etienne/Desktop" dev=sda8ino=1237000 Can we make SMACK[smack_inode_getarr] into key=value pairs too and get rid of that extra ':'? Anyone have naming suggestions? lsm=SMACK function=smack_inode_getattr also: dev=sda8ino=1237000 I'm guessing that was just a typo of you putting the example into the e-mail, but you may want to double check. -Eric -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/