From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-1.0 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_PASS autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 93BFFC10F13 for ; Thu, 11 Apr 2019 12:22:57 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 61CD22133D for ; Thu, 11 Apr 2019 12:22:57 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726784AbfDKMW4 (ORCPT ); Thu, 11 Apr 2019 08:22:56 -0400 Received: from mx1.redhat.com ([209.132.183.28]:52260 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726014AbfDKMWz (ORCPT ); Thu, 11 Apr 2019 08:22:55 -0400 Received: from smtp.corp.redhat.com (int-mx05.intmail.prod.int.phx2.redhat.com [10.5.11.15]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 4517F30832DE; Thu, 11 Apr 2019 12:22:55 +0000 (UTC) Received: from ivy-bridge (ovpn-117-47.ams2.redhat.com [10.36.117.47]) by smtp.corp.redhat.com (Postfix) with ESMTP id CF2295D6A9; Thu, 11 Apr 2019 12:22:46 +0000 (UTC) Date: Thu, 11 Apr 2019 14:22:47 +0200 From: Steve Grubb To: Richard Guy Briggs Cc: LKML , Linux-Audit Mailing List , Paul Moore , omosnace@redhat.com, eparis@parisplace.org, ebiederm@xmission.com, oleg@redhat.com Subject: Re: [PATCH ghak111 V1] audit: deliver siginfo regarless of syscall Message-ID: <20190411142247.1a7a3639@ivy-bridge> In-Reply-To: <20190409155728.dfp4qwseo6jxdmqr@madcap2.tricolour.ca> References: <20190409080138.745d18a1@ivy-bridge> <20190409140259.n4t6rxb24eu3uzvp@madcap2.tricolour.ca> <20190409173716.1a0308fb@ivy-bridge> <20190409155728.dfp4qwseo6jxdmqr@madcap2.tricolour.ca> Organization: Red Hat MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-Scanned-By: MIMEDefang 2.79 on 10.5.11.15 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.44]); Thu, 11 Apr 2019 12:22:55 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, 9 Apr 2019 11:57:28 -0400 Richard Guy Briggs wrote: > On 2019-04-09 17:37, Steve Grubb wrote: > > On Tue, 9 Apr 2019 10:02:59 -0400 > > Richard Guy Briggs wrote: > > > > > On 2019-04-09 08:01, Steve Grubb wrote: > > > > On Mon, 8 Apr 2019 23:52:29 -0400 Richard Guy Briggs > > > > wrote: > > > > > When a process signals the audit daemon (shutdown, rotate, > > > > > resume, reconfig) but syscall auditing is not enabled, we > > > > > still want to know the identity of the process sending the > > > > > signal to the audit daemon. > > > > > > > > Why? If syscall auditing is disabled, then there is no > > > > requirement to provide anything. What is the real problem that > > > > you are seeing? > > > > > > Shutdown messages with -1 in them rather than the real values. > > > > OK. We can fix that by patching auditd to see if auditing is enabled > > before requesting signal info. If auditing is disabled, the proper > > action is for the kernel to ignore any audit userspace messages > > except the configuration commands. > > If auditing is disabled in the kernel, none of this is trackable. It > is for those as yet unsupported arches that can run audit enabled but > without auditsyscall support. Ok. I suppose this is useful for this use case. No further objections. -Steve