Re: [PATCH v6] audit: log AUDIT_TIME_* records only from rules

On Tue, Feb 22, 2022 at 11:45 AM Richard Guy Briggs <rgb(a)redhat.com&gt; wrote: > AUDIT_TIME_* events are generated when there are syscall rules present > that are not related to time keeping. This will produce noisy log > entries that could flood the logs and hide events we really care about. > > Rather than immediately produce the AUDIT_TIME_* records, store the data > in the context and log it at syscall exit time respecting the filter > rules. > > Note: This eats the audit_buffer, unlike any others in show_special(). > > Please see https://bugzilla.redhat.com/show_bug.cgi?id=1991919 > > Fixes: 7e8eda734d30 ("ntp: Audit NTP parameters adjustment") > Fixes: 2d87a0674bd6 ("timekeeping: Audit clock adjustments") > Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com&gt; > --- > Changelog: > v2: > - rename __audit_ntp_log_ to audit_log_ntp > - pre-check ntp before storing > - move tk out of the context union and move ntp logging to the bottom of audit_show_special() > - restructure logging of ntp to use ab and allocate more only if more > - add Fixes lines > v3 > - move tk into union > - rename audit_log_ntp() to audit_log_time() and add tk > - key off both AUDIT_TIME_* but favour NTP > v4 > - drop tk goto in favour of ntp if clause > - add comments to clarify calling function buffer expectations > v5 > - hold my nose and swallow the audit_buffer in audit_log_time() > v6 > - declare audit_log_time() and ntp_name as static > > kernel/audit.h | 4 +++ > kernel/auditsc.c | 85 ++++++++++++++++++++++++++++++++++++------------ > 2 files changed, 69 insertions(+), 20 deletions(-) Merged into audit/next.

paul-moore.com