From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932806AbcFCUYk (ORCPT ); Fri, 3 Jun 2016 16:24:40 -0400 Received: from mx1.redhat.com ([209.132.183.28]:36477 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932507AbcFCUYa (ORCPT ); Fri, 3 Jun 2016 16:24:30 -0400 Date: Fri, 3 Jun 2016 16:24:26 -0400 From: Richard Guy Briggs To: Paul Moore Cc: linux-audit@redhat.com, linux-kernel@vger.kernel.org Subject: Re: [PATCH] audit: add fields to exclude filter by reusing user filter Message-ID: <20160603202426.GJ1759@madcap2.tricolour.ca> References: <3ff3a1c2837c8045bb54058effd11edd897b6412.1464810610.git.rgb@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.21 (2010-09-15) X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.25]); Fri, 03 Jun 2016 20:24:30 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 16/06/03, Paul Moore wrote: > On Wed, Jun 1, 2016 at 6:50 PM, Richard Guy Briggs wrote: > > RFE: add additional fields for use in audit filter exclude rules > > https://github.com/linux-audit/audit-kernel/issues/5 > > > > Re-factor audit_filter_type() to use audit_filter_user_rules() to enable > > exclude filter to additionally filter on PID, UID, GID, AUID, > > LOGINUID_SET, SUBJ_*. > > > > Add check in audit_filter_user() to quit early if list is empty. > > > > Signed-off-by: Richard Guy Briggs > > --- > > kernel/auditfilter.c | 22 +++++++++------------- > > 1 files changed, 9 insertions(+), 13 deletions(-) > > I like the consolidation between audit_filter_type() and > audit_filter_user(), I like it so much I think we should take it > further. Let's consolidate both functions into a single function (say > audit_filter()?) and update the callers to use the new function. This > shouldn't be hard as the only callers are audit_receive_msg() and > audit_log_start(); you'll need to be careful as the return values of > the current functions are opposite of each other, but it should be > easy enough to update one of the callers. > > Sound reasonable? Potentially... I was even eyeing kernel/auditsc.c::audit_filter_rules() for re-factoring... > > diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c > > index 96c9a1b..515c752 100644 > > --- a/kernel/auditfilter.c > > +++ b/kernel/auditfilter.c > > @@ -1358,6 +1358,9 @@ int audit_filter_user(int type) > > ret = 1; /* Audit by default */ > > > > rcu_read_lock(); > > + if (list_empty(&audit_filter_list[AUDIT_FILTER_USER])) > > + goto unlock_and_return; > > + > > list_for_each_entry_rcu(e, &audit_filter_list[AUDIT_FILTER_USER], list) { > > rc = audit_filter_user_rules(&e->rule, type, &state); > > if (rc) { > > @@ -1366,13 +1369,14 @@ int audit_filter_user(int type) > > break; > > } > > } > > +unlock_and_return: > > rcu_read_unlock(); > > - > > return ret; > > } > > > > int audit_filter_type(int type) > > { > > + enum audit_state state = AUDIT_DISABLED; > > struct audit_entry *e; > > int result = 0; > > > > @@ -1380,19 +1384,11 @@ int audit_filter_type(int type) > > if (list_empty(&audit_filter_list[AUDIT_FILTER_TYPE])) > > goto unlock_and_return; > > > > - list_for_each_entry_rcu(e, &audit_filter_list[AUDIT_FILTER_TYPE], > > - list) { > > - int i; > > - for (i = 0; i < e->rule.field_count; i++) { > > - struct audit_field *f = &e->rule.fields[i]; > > - if (f->type == AUDIT_MSGTYPE) { > > - result = audit_comparator(type, f->op, f->val); > > - if (!result) > > - break; > > - } > > + list_for_each_entry_rcu(e, &audit_filter_list[AUDIT_FILTER_TYPE], list) { > > + if (audit_filter_user_rules(&e->rule, type, &state) == 1) { > > + result = 1; > > + break; > > } > > - if (result) > > - goto unlock_and_return; > > } > > unlock_and_return: > > rcu_read_unlock(); > > -- > > 1.7.1 > > > > -- > > Linux-audit mailing list > > Linux-audit@redhat.com > > https://www.redhat.com/mailman/listinfo/linux-audit > > > > -- > paul moore > www.paul-moore.com - RGB -- Richard Guy Briggs Kernel Security Engineering, Base Operating Systems, Red Hat Remote, Ottawa, Canada Voice: +1.647.777.2635, Internal: (81) 32635