Re: [PATCH ghak122 v1] audit: store event sockaddr in case of no rules
On 2020-07-13 20:11, Paul Moore wrote:
On Mon, Jul 13, 2020 at 7:09 PM Casey Schaufler
<casey(a)schaufler-ca.com> wrote:
> ... but it does appear that I could switch to using your audit_alloc_local().
In my opinion, linking the audit container ID and LSM stacking
patchsets would seem like a very big mistake, especially since the
consolidation you are describing could be done after the fact without
any disruption to the kernel/userspace interface. I would strongly
encourage both patchsets to remain self-contained if at all possible
so as to not jeopardize each other.
I see no need to link them. The audit_alloc_local() patch could stand
on its own to be used by either patchset and doesn't need to be included
in the contid patchset. There is no mention of contid in it. Patches 8
and 11 depend on it so as long as it is already upstream that's fine.
Of course, we could send a fixup patch after both patchsets are accepted
upstream to merge the functionality of the two.
paul moore
- RGB
--
Richard Guy Briggs <rgb(a)redhat.com>
Sr. S/W Engineer, Kernel Security, Base Operating Systems
Remote, Ottawa, Red Hat Canada
IRC: rgb, SunRaycer
Voice: +1.647.777.2635, Internal: (81) 32635