Re: [PATCH] [BZ905179] audit: omit check for uid and gid validity in audit rules and data

On Tue, Apr 09, 2013 at 02:16:22PM -0700, Eric W. Biederman wrote: > Steve Grubb <sgrubb(a)redhat.com&gt; writes: > > On Tuesday, April 09, 2013 02:39:32 AM Eric W. Biederman wrote: > >> Andrew Morton <akpm(a)linux-foundation.org&gt; writes: > >> > On Wed, 20 Mar 2013 15:18:17 -0400 Richard Guy Briggs <rgb(a)redhat.com&gt; wrote: > >> >> audit rule additions containing "-F auid!=4294967295" were failing with > >> >> EINVAL. > >> >> > >> >> UID_INVALID (and GID_INVALID) is actually a valid uid (gid) for setting > >> >> and > >> >> testing against audit rules. Remove the check for invalid uid and gid > >> >> when > >> >> parsing rules and data for logging. > >> > >> In general testing against invalid uid appears completely bogus, and > >> should always return true. As it is and essentially always has been > >> incorrect to explicitly set any kernel uid to that value. > > > > This is the unset value that daemons would have. > > As their uid, or gid, or euid, or fsuid. Not in the least. Point taken that only a value of UID_INVALID should be accepted for auid.

> And no one has much cared > about the audit subsystem this "breakage" of the audit > subsystem. Despite things failing with a clear error code. So there are > two choices. We mark the audit subsystem as broken moving it to staging > and then delete it because no one cares enough to look after it and > maintain it. Or we have a constructive conversation about what to do > with it. Ok, politics aside... > I have proposed a patch that will preserve the existing behavior while > adding maintainable semantics. Will someone who cares please test my > proposed fix? I'll test it.

> Eric - RGB