Re: [PATCH ghak10 v5 1/2] audit: Add functions to log time adjustments

On Thu, Sep 13, 2018 at 9:59 AM Ondrej Mosnacek <omosnace(a)redhat.com&gt; wrote: > On Mon, Aug 27, 2018 at 6:38 PM Steve Grubb <sgrubb(a)redhat.com&gt; wrote: > > On Monday, August 27, 2018 5:13:17 AM EDT Ondrej Mosnacek wrote: > > > On Mon, Aug 27, 2018 at 9:50 AM Miroslav Lichvar <mlichvar(a)redhat.com&gt; > > wrote: > > > > On Fri, Aug 24, 2018 at 02:00:00PM +0200, Ondrej Mosnacek wrote: > > > > > This patch adds two auxiliary record types that will be used to > > > > > annotate > > > > > the adjtimex SYSCALL records with the NTP/timekeeping values that have > > > > > been changed. > > > > > > > > It seems the "adjust" function intentionally logs also calls/modes > > > > that don't actually change anything. Can you please explain it a bit > > > > in the message? > > > > > > > > NTP/PTP daemons typically don't read the adjtimex values in a normal > > > > operation and overwrite them on each update, even if they don't > > > > change. If the audit function checked that oldval != newval, the > > > > number of messages would be reduced and it might be easier to follow. > > > > > > We actually want to log any attempt to change a value, as even an > > > intention to set/change something could be a hint that the process is > > > trying to do something bad (see discussion at [1]). > > > > One of the problems is that these applications can flood the logs very > > quickly. An attempt to change is not needed unless it fails for permissions > > reasons. So, limiting to actual changes is probably a good thing. > > Well, Richard seemed to "violently" agree with the opposite, so now I > don't know which way to go... Paul, you are the official tie-breaker > here, which do you prefer? The general idea is that we only care about *changes* to the system state, so if a process is setting a variable to with a value that matches it's current value I see no reason why we need to generate a change record. Another thing to keep in mind, we can always change the behavior to be more verbose (*always* generate a record, regardless of value) without likely causing a regression, but limiting records is more difficult and more likely to cause regressions.

-- paul moore www.paul-moore.com