4:53 p.m.
Kernel patch is pretty simple, straightforward...
- Add a new, 5th filter called "exclude".
- And add a new field AUDIT_MSGTYPE.
- Define a new function audit_filter_exclude() that takes a message type
as input and examines all rules in the filter. It returns '1' if the
message is to be excluded, and '0' otherwise.
- Call the audit_filter_exclude() function near the top of
audit_log_start() just after asserting audit_initialized. If the
message type is not to be audited, return NULL very early, before doing
a lot of work.
Comments welcome.
:-Dustin
diff -urpN linux-2.6.14-rc4-audit_ops/include/linux/audit.h
linux-2.6.14-rc4-audit_ops-exclude/include/linux/audit.h
--- linux-2.6.14-rc4-audit_ops/include/linux/audit.h 2005-10-26 16:12:42.000000000 -0500
+++ linux-2.6.14-rc4-audit_ops-exclude/include/linux/audit.h 2005-10-31 15:51:02.000000000
-0600
@@ -81,8 +81,9 @@
#define AUDIT_FILTER_ENTRY 0x02 /* Apply rule at syscall entry */
#define AUDIT_FILTER_WATCH 0x03 /* Apply rule to file system watches */
#define AUDIT_FILTER_EXIT 0x04 /* Apply rule at syscall exit */
+#define AUDIT_FILTER_EXCLUDE 0x05 /* Apply rule early, at audit_log_start */
-#define AUDIT_NR_FILTERS 5
+#define AUDIT_NR_FILTERS 6
#define AUDIT_FILTER_PREPEND 0x10 /* Prepend to front of list */
@@ -121,6 +122,7 @@
#define AUDIT_LOGINUID 9
#define AUDIT_PERS 10
#define AUDIT_ARCH 11
+#define AUDIT_MSGTYPE 12
/* These are ONLY useful when checking
* at syscall exit time (AUDIT_AT_EXIT). */
@@ -265,6 +267,7 @@ extern int audit_sockaddr(int len, void
extern int audit_avc_path(struct dentry *dentry, struct vfsmount *mnt);
extern void audit_signal_info(int sig, struct task_struct *t);
extern int audit_filter_user(struct netlink_skb_parms *cb, int type);
+extern int audit_filter_exclude(int type);
#else
#define audit_alloc(t) ({ 0; })
#define audit_free(t) do { ; } while (0)
diff -urpN linux-2.6.14-rc4-audit_ops/kernel/audit.c
linux-2.6.14-rc4-audit_ops-exclude/kernel/audit.c
--- linux-2.6.14-rc4-audit_ops/kernel/audit.c 2005-10-21 12:35:50.000000000 -0500
+++ linux-2.6.14-rc4-audit_ops-exclude/kernel/audit.c 2005-11-01 16:01:57.000000000 -0600
@@ -659,6 +659,10 @@ struct audit_buffer *audit_log_start(str
if (!audit_initialized)
return NULL;
+ if (unlikely(audit_filter_exclude(type))) {
+ return NULL;
+ }
+
if (gfp_mask & __GFP_WAIT)
reserve = 0;
else
diff -urpN linux-2.6.14-rc4-audit_ops/kernel/auditsc.c
linux-2.6.14-rc4-audit_ops-exclude/kernel/auditsc.c
--- linux-2.6.14-rc4-audit_ops/kernel/auditsc.c 2005-10-27 14:17:41.000000000 -0500
+++ linux-2.6.14-rc4-audit_ops-exclude/kernel/auditsc.c 2005-11-01 14:02:25.000000000
-0600
@@ -181,7 +181,8 @@ static struct list_head audit_filter_lis
LIST_HEAD_INIT(audit_filter_list[2]),
LIST_HEAD_INIT(audit_filter_list[3]),
LIST_HEAD_INIT(audit_filter_list[4]),
-#if AUDIT_NR_FILTERS != 5
+ LIST_HEAD_INIT(audit_filter_list[5]),
+#if AUDIT_NR_FILTERS != 6
#error Fix audit_filter_list initialiser
#endif
};
@@ -663,6 +664,33 @@ int audit_filter_user(struct netlink_skb
return ret; /* Audit by default */
}
+int audit_filter_exclude(int type)
+{
+ struct audit_entry *e;
+ int result = 0;
+
+ rcu_read_lock();
+ list_for_each_entry_rcu(e, &audit_filter_list[AUDIT_FILTER_EXCLUDE], list) {
+ struct audit_rule *rule = &e->rule;
+ int i;
+ for (i = 0; i < rule->field_count; i++) {
+ u32 field = rule->fields[i] & ~AUDIT_OPERATORS;
+ u32 op = rule->fields[i] & AUDIT_OPERATORS;
+ u32 value = rule->values[i];
+ if ( field == AUDIT_MSGTYPE ) {
+ result = audit_comparator(type, op, value);
+ if (!result) {
+ rcu_read_unlock();
+ return result;
+ }
+ }
+ }
+ }
+ rcu_read_unlock();
+ return result;
+}
+
+
/* This should be called with task_lock() held. */
static inline struct audit_context *audit_get_context(struct task_struct *tsk,
int return_valid,
7:23 a.m.
On Tuesday 01 November 2005 17:53, Dustin Kirkland wrote:
- Define a new function audit_filter_exclude() that takes a message
type
as input and examines all rules in the filter. It returns '1' if the
message is to be excluded, and '0' otherwise.
You should check that the list is empty and short circuit. This will be the
case %99.99 of the time.
-Steve
9:47 a.m.
On Tue, 2005-11-01 at 16:53 -0600, Dustin Kirkland wrote:
Kernel patch is pretty simple, straightforward...
Technically fine, but lacks justification for doing this in the kernel.
The kernel should do preliminary filtering _only_ to the extent that it
really needs to do so, to keep the volume of messages sent up to
userspace to an appropriate level.
It's clear that we need to do a first-pass at throwing away unneeded
syscall audit records, because otherwise the system would grind to a
halt as we shove a report for _every_ syscall up the pipe to auditd.
But it's not clear that this filtering is of the same nature -- can you
explain the anticipated use case and show why it's necessary to add this
particular filter to the _kernel_ instead of doing it in userspace?
--
dwmw2
9:59 a.m.
On Wednesday 02 November 2005 10:47, David Woodhouse wrote:
But it's not clear that this filtering is of the same nature --
can you
explain the anticipated use case and show why it's necessary to add this
particular filter to the _kernel_ instead of doing it in userspace?
The main use case is to allow the admin to reject certain classes of records.
Perhaps they do not want to have any LSPP record or SE Linux avc messages.
They could have the kernel to filter those out. There are still people that
do not run the audit daemon and do not want avcs in their syslogs or on their
screens. This allows them to shut it off.
This also allows an admin to tune what information is going to the audit
daemon when the system is very busy and is overwhelming the audit daemon. For
some people having syscalls go onto wait queue is not something they want.
They would like a fine grained way to pick what gets kept. This allows it.
There was a proposal put out here:
https://www.redhat.com/archives/linux-audit/2005-September/msg00061.html
There were no comments saying no one should do this. If anyone has objections
to anything on that list, please discuss it now before people waste their
time on something that will be rejected.
-Steve
7:58 a.m.
Hi Dustin,
On Tue, Nov 01, 2005 at 04:53:28PM -0600, Dustin Kirkland wrote:
Kernel patch is pretty simple, straightforward...
- Add a new, 5th filter called "exclude".
Per discussion in another part of this thread, one of the stated
reasons for introducing this filtering is for people running a minimal
audit setup.
What about someone running a kernel without CONFIG_AUDITSYSCALL? With
this implementation, they wouldn't be able to use this filtering at
all. That doesn't make any sense, since filtering audit record types
is inherently unrelated to syscalls. This filtering applies to audit
in general, so it should live entirely in audit.c.
Thanks,
Amy
- And add a new field AUDIT_MSGTYPE.
- Define a new function audit_filter_exclude() that takes a message type
as input and examines all rules in the filter. It returns '1' if the
message is to be excluded, and '0' otherwise.
- Call the audit_filter_exclude() function near the top of
audit_log_start() just after asserting audit_initialized. If the
message type is not to be audited, return NULL very early, before doing
a lot of work.
Comments welcome.
:-Dustin
diff -urpN linux-2.6.14-rc4-audit_ops/include/linux/audit.h
linux-2.6.14-rc4-audit_ops-exclude/include/linux/audit.h
--- linux-2.6.14-rc4-audit_ops/include/linux/audit.h 2005-10-26 16:12:42.000000000 -0500
+++ linux-2.6.14-rc4-audit_ops-exclude/include/linux/audit.h 2005-10-31
15:51:02.000000000 -0600
@@ -81,8 +81,9 @@
#define AUDIT_FILTER_ENTRY 0x02 /* Apply rule at syscall entry */
#define AUDIT_FILTER_WATCH 0x03 /* Apply rule to file system watches */
#define AUDIT_FILTER_EXIT 0x04 /* Apply rule at syscall exit */
+#define AUDIT_FILTER_EXCLUDE 0x05 /* Apply rule early, at audit_log_start */
-#define AUDIT_NR_FILTERS 5
+#define AUDIT_NR_FILTERS 6
#define AUDIT_FILTER_PREPEND 0x10 /* Prepend to front of list */
@@ -121,6 +122,7 @@
#define AUDIT_LOGINUID 9
#define AUDIT_PERS 10
#define AUDIT_ARCH 11
+#define AUDIT_MSGTYPE 12
/* These are ONLY useful when checking
* at syscall exit time (AUDIT_AT_EXIT). */
@@ -265,6 +267,7 @@ extern int audit_sockaddr(int len, void
extern int audit_avc_path(struct dentry *dentry, struct vfsmount *mnt);
extern void audit_signal_info(int sig, struct task_struct *t);
extern int audit_filter_user(struct netlink_skb_parms *cb, int type);
+extern int audit_filter_exclude(int type);
#else
#define audit_alloc(t) ({ 0; })
#define audit_free(t) do { ; } while (0)
diff -urpN linux-2.6.14-rc4-audit_ops/kernel/audit.c
linux-2.6.14-rc4-audit_ops-exclude/kernel/audit.c
--- linux-2.6.14-rc4-audit_ops/kernel/audit.c 2005-10-21 12:35:50.000000000 -0500
+++ linux-2.6.14-rc4-audit_ops-exclude/kernel/audit.c 2005-11-01 16:01:57.000000000
-0600
@@ -659,6 +659,10 @@ struct audit_buffer *audit_log_start(str
if (!audit_initialized)
return NULL;
+ if (unlikely(audit_filter_exclude(type))) {
+ return NULL;
+ }
+
if (gfp_mask & __GFP_WAIT)
reserve = 0;
else
diff -urpN linux-2.6.14-rc4-audit_ops/kernel/auditsc.c
linux-2.6.14-rc4-audit_ops-exclude/kernel/auditsc.c
--- linux-2.6.14-rc4-audit_ops/kernel/auditsc.c 2005-10-27 14:17:41.000000000 -0500
+++ linux-2.6.14-rc4-audit_ops-exclude/kernel/auditsc.c 2005-11-01 14:02:25.000000000
-0600
@@ -181,7 +181,8 @@ static struct list_head audit_filter_lis
LIST_HEAD_INIT(audit_filter_list[2]),
LIST_HEAD_INIT(audit_filter_list[3]),
LIST_HEAD_INIT(audit_filter_list[4]),
-#if AUDIT_NR_FILTERS != 5
+ LIST_HEAD_INIT(audit_filter_list[5]),
+#if AUDIT_NR_FILTERS != 6
#error Fix audit_filter_list initialiser
#endif
};
@@ -663,6 +664,33 @@ int audit_filter_user(struct netlink_skb
return ret; /* Audit by default */
}
+int audit_filter_exclude(int type)
+{
+ struct audit_entry *e;
+ int result = 0;
+
+ rcu_read_lock();
+ list_for_each_entry_rcu(e, &audit_filter_list[AUDIT_FILTER_EXCLUDE], list) {
+ struct audit_rule *rule = &e->rule;
+ int i;
+ for (i = 0; i < rule->field_count; i++) {
+ u32 field = rule->fields[i] & ~AUDIT_OPERATORS;
+ u32 op = rule->fields[i] & AUDIT_OPERATORS;
+ u32 value = rule->values[i];
+ if ( field == AUDIT_MSGTYPE ) {
+ result = audit_comparator(type, op, value);
+ if (!result) {
+ rcu_read_unlock();
+ return result;
+ }
+ }
+ }
+ }
+ rcu_read_unlock();
+ return result;
+}
+
+
/* This should be called with task_lock() held. */
static inline struct audit_context *audit_get_context(struct task_struct *tsk,
int return_valid,
--
Linux-audit mailing list
Linux-audit(a)redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit
8:39 a.m.
On Thursday 03 November 2005 08:58, Amy Griffis wrote:
What about someone running a kernel without CONFIG_AUDITSYSCALL?
With
this implementation, they wouldn't be able to use this filtering at
all. That doesn't make any sense, since filtering audit record types
is inherently unrelated to syscalls. This filtering applies to audit
in general, so it should live entirely in audit.c.
It might be tricky to untangle. I think it uses functions that only live in
that file. I think its worth looking into, though.
-Steve
10:30 a.m.
On Thursday 03 November 2005 08:39, Steve Grubb wrote:
On Thursday 03 November 2005 08:58, Amy Griffis wrote:
> What about someone running a kernel without CONFIG_AUDITSYSCALL? With
> this implementation, they wouldn't be able to use this filtering at
> all. That doesn't make any sense, since filtering audit record types
> is inherently unrelated to syscalls. This filtering applies to audit
> in general, so it should live entirely in audit.c.
It might be tricky to untangle. I think it uses functions that only live in
that file. I think its worth looking into, though.
-Steve
This shortcoming also appears with user message filtering. Right?
-tim
1:20 p.m.
On Thu, Nov 03, 2005 at 10:30:16AM -0600, Timothy R. Chavez wrote:
On Thursday 03 November 2005 08:39, Steve Grubb wrote:
> On Thursday 03 November 2005 08:58, Amy Griffis wrote:
> > What about someone running a kernel without CONFIG_AUDITSYSCALL? ?With
> > this implementation, they wouldn't be able to use this filtering at
> > all. ?That doesn't make any sense, since filtering audit record types
> > is inherently unrelated to syscalls. ?This filtering applies to audit
> > in general, so it should live entirely in audit.c. ?
>
> It might be tricky to untangle. I think it uses functions that only live in
> that file. I think its worth looking into, though.
>
> -Steve
>
This shortcoming also appears with user message filtering. Right?
Yes, and that doesn't make sense either. :-)
1:51 p.m.
On Thu, 2005-11-03 at 14:20 -0500, Amy Griffis wrote:
On Thu, Nov 03, 2005 at 10:30:16AM -0600, Timothy R. Chavez wrote:
> This shortcoming also appears with user message filtering. Right?
Yes, and that doesn't make sense either. :-)
From include/linux/audit.h:
#define AUDIT_FILTER_USER 0x00 /* Apply rule to user-generated messages */
#define AUDIT_FILTER_TASK 0x01 /* Apply rule at task creation (not syscall) */
#define AUDIT_FILTER_ENTRY 0x02 /* Apply rule at syscall entry */
#define AUDIT_FILTER_WATCH 0x03 /* Apply rule to file system watches */
#define AUDIT_FILTER_EXIT 0x04 /* Apply rule at syscall exit */
#define AUDIT_FILTER_EXCLUDE 0x05 /* Apply rule at audit_log_start */
So out of all of these, AUDIT_FILTER_ENTRY and AUDIT_FILTER_EXIT are the
only two that are 'inherently syscall related', a minority in fact.
If AUDIT_FILTER_EXCLUDE doesn't belong in auditsc.c, then neither does
_USER, _TASK, _WATCH.
I agree that these might be better placed elsewhere, but it's not the
business of this patch to go about moving these things around. What are
your thoughts on solving this properly for all filters? Note that this
probably belongs in a thread of its own...
Dustin
7:46 a.m.
On Thu, Nov 03, 2005 at 01:51:07PM -0600, Dustin Kirkland wrote:
From include/linux/audit.h:
#define AUDIT_FILTER_USER 0x00 /* Apply rule to user-generated messages */
#define AUDIT_FILTER_TASK 0x01 /* Apply rule at task creation (not syscall) */
#define AUDIT_FILTER_ENTRY 0x02 /* Apply rule at syscall entry */
#define AUDIT_FILTER_WATCH 0x03 /* Apply rule to file system watches */
#define AUDIT_FILTER_EXIT 0x04 /* Apply rule at syscall exit */
#define AUDIT_FILTER_EXCLUDE 0x05 /* Apply rule at audit_log_start */
So out of all of these, AUDIT_FILTER_ENTRY and AUDIT_FILTER_EXIT are the
only two that are 'inherently syscall related', a minority in fact.
AUDIT_FILTER_TASK is syscall related. It determines whether context
should be collected for syscall filtering.
AUDIT_FILTER_WATCH is not is use in the upstream kernels, and will not
be used in this iteration of filesystem audit code.
AUDIT_FILTER_USER is not syscall related and should not have been
implemented as such. Stuffing it in the syscall filtering code was
lazy.
If AUDIT_FILTER_EXCLUDE doesn't belong in auditsc.c, then neither
does
_USER, _TASK, _WATCH.
Correct, other than _TASK which does belong.
I agree that these might be better placed elsewhere, but it's not
the
business of this patch to go about moving these things around.
Broken modularity is not something we want to perpetuate. Why add to
the bad reputation this audit implementation already has?
What are your thoughts on solving this properly for all filters?
Either make the filtering code general to audit, or use a separate
implementation for user-space filtering and record-type exclusion. As
I've mentioned previously, I think the record-type exclusion could be
implemented in a better way.
Amy
9:43 a.m.
New subject: [PATCH] (1/2) new audit filter allows excluding messages by type (kernel)
Steve Grubb wrote:
On Wednesday 09 November 2005 08:46, Amy Griffis wrote:
>AUDIT_FILTER_USER is not syscall related and should not have been
>implemented as such. Stuffing it in the syscall filtering code was
>lazy.
I'm thinking that you are completely misunderstanding all of this.
Maybe you could explain?
-- ljk
1:20 p.m.
New subject: [PATCH] (1/2) new audit filter allows excluding messages by type (kernel)
On Wednesday 09 November 2005 10:43, Linda Knippers wrote:
>>AUDIT_FILTER_USER is not syscall related and should not have
been
>>implemented as such. Stuffing it in the syscall filtering code was
>>lazy.
>
> I'm thinking that you are completely misunderstanding all of this.
Maybe you could explain?
I'm completely misunderstanding Amy's mail. Sorry.
Dustin's patch is good and is a complete unit of work. Its job is not really
to separate things that fall under the two kernel config options. A new patch
that moves things around should be created and it should be discussed on a
new thread.
-Steve
1:54 p.m.
New subject: [PATCH] (1/2) new audit filter allows excluding messages by type (kernel)
On Wed, 2005-11-09 at 14:20 -0500, Steve Grubb wrote:
On Wednesday 09 November 2005 10:43, Linda Knippers wrote:
> >>AUDIT_FILTER_USER is not syscall related and should not have been
> >>implemented as such. Stuffing it in the syscall filtering code was
> >>lazy.
> >
> > I'm thinking that you are completely misunderstanding all of this.
>
> Maybe you could explain?
I'm completely misunderstanding Amy's mail. Sorry.
Dustin's patch is good and is a complete unit of work. Its job is not really
to separate things that fall under the two kernel config options. A new patch
that moves things around should be created and it should be discussed on a
new thread.
For the benefit of everyone else, we discussed this on the LSPP
conference call today and David will work on a patch that moves the
filtering functionality out of the syscall scope where belongs.
While I think we're in agreement that Amy is correct in asking that the
filters be moved elsewhere, that's not the business of the patch in the
current thread. It's duly noted and David will be working on it.
:-Dustin
7:23 p.m.
New subject: [PATCH 1/1] audit: fix logic error in audit_filter_exclude()
From: Dustin Kirkland (IBM)
There's supposed to be an implicit AND between all subsequent rules in a
given filter list. There's supposed to be an implicit OR between all
subsequent filters of a given type. The way the audit_filter_exclude()
code currently operates, it forces an implicit AND between all rules in
all exclude filters. This trivial patch fixes that problem with correct
logic. If any one of the rules fails in a given list, break out of
examining that list and move on to the next list. If all rules succeed
in a given list, return 1.
Signed-off-by: Dustin Kirkland <dustin.kirkland(a)us.ibm.com>
---
David-
Synced to your updated git tree, built, and tested the patches of mine
you integrated, which turned up a somewhat buried bug.
Also note:
1) this message should be spliced into the correct thread of your mailer
2) the text of the patch should be correctly insert into the body of
this mail
3) I'm attempting to use the Canonical Patch Format ;)
Please let me know if this is the appropriate format and I'll use it
from now on when final versions of a given patch are ready.
Thanks,
:-Dustin
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -689,9 +689,11 @@ int audit_filter_exclude(int type)
if ( field == AUDIT_MSGTYPE ) {
result = audit_comparator(type, op, value);
if (!result)
- goto unlock_and_return;
+ break;
}
}
+ if (result)
+ goto unlock_and_return;
}
unlock_and_return:
rcu_read_unlock();
8:37 a.m.
New subject: [PATCH 1/1] audit: fix naming inconsistency, s/AUDIT_FILTER_EXCLUDE/AUDIT_FILTER_TYPE/
From: Dustin Kirkland (IBM)
Previously existing filters are named AUDIT_FILTER_USER, *_TASK,
*_ENTRY, *_WATCH, and *_EXIT. These fall into two categories: what is
filtered or when the filter applies. AUDIT_FILTER_EXCLUDE fits into
neither of these categories. For the sake of consistency,
AUDIT_FILTER_EXCLUDE and audit_filter_exclude() are changed to
AUDIT_FILTER_TYPE and audit_filter_type() as the message type is the
only operand to this filter.
Signed-off-by: Dustin Kirkland <dustin.kirkland(a)us.ibm.com>
---
diff --git a/include/linux/audit.h b/include/linux/audit.h
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -92,7 +92,7 @@
#define AUDIT_FILTER_ENTRY 0x02 /* Apply rule at syscall entry */
#define AUDIT_FILTER_WATCH 0x03 /* Apply rule to file system watches */
#define AUDIT_FILTER_EXIT 0x04 /* Apply rule at syscall exit */
-#define AUDIT_FILTER_EXCLUDE 0x05 /* Apply rule at audit_log_start */
+#define AUDIT_FILTER_TYPE 0x05 /* Apply rule at audit_log_start */
#define AUDIT_NR_FILTERS 6
@@ -291,7 +291,7 @@ extern int audit_sockaddr(int len, void
extern int audit_avc_path(struct dentry *dentry, struct vfsmount *mnt);
extern void audit_signal_info(int sig, struct task_struct *t);
extern int audit_filter_user(struct netlink_skb_parms *cb, int type);
-extern int audit_filter_exclude(int type);
+extern int audit_filter_type(int type);
extern char *audit_ipc_context(struct kern_ipc_perm *ipcp);
extern int audit_set_macxattr(const char *name);
#else
diff --git a/kernel/audit.c b/kernel/audit.c
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -700,7 +700,7 @@ struct audit_buffer *audit_log_start(str
if (!audit_initialized)
return NULL;
- if (unlikely(audit_filter_exclude(type)))
+ if (unlikely(audit_filter_type(type)))
return NULL;
if (gfp_mask & __GFP_WAIT)
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -669,16 +669,16 @@ int audit_filter_user(struct netlink_skb
return ret; /* Audit by default */
}
-int audit_filter_exclude(int type)
+int audit_filter_type(int type)
{
struct audit_entry *e;
int result = 0;
rcu_read_lock();
- if (list_empty(&audit_filter_list[AUDIT_FILTER_EXCLUDE]))
+ if (list_empty(&audit_filter_list[AUDIT_FILTER_TYPE]))
goto unlock_and_return;
- list_for_each_entry_rcu(e, &audit_filter_list[AUDIT_FILTER_EXCLUDE],
+ list_for_each_entry_rcu(e, &audit_filter_list[AUDIT_FILTER_TYPE],
list) {
struct audit_rule *rule = &e->rule;
int i;
6983
days inactive
6991
days old
linux-audit@lists.linux-audit.osci.io
15 comments
6 participants
participants (6)
-
Amy Griffis -
David Woodhouse -
Dustin Kirkland -
Linda Knippers -
Steve Grubb -
Timothy R. Chavez