Re: [PATCH] bpf: emit audit messages upon successful prog load and unload

On Fri, Nov 22, 2019 at 2:24 PM Jiri Olsa <jolsa(a)redhat.com&gt; wrote: > Paul, > would following output be ok: > > type=SYSCALL msg=audit(1574445211.897:28015): arch=c000003e syscall=321 > success=no exit=-13 a0=5 a1=7fff09ac6c60 a2=78 a3=6 items=0 ppid=1408 > pid=9266 auid=1001 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 > fsgid=0 tty=pts0 ses=1 comm="test_verifier" > exe="/home/jolsa/linux/tools/testing/selftests/bpf/test_verifier" > subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 > key=(null)ARCH=x86_64 SYSCALL=bpf AUID="jolsa" UID="root" GID="root" > EUID="root" SUID="root" FSUID="root" EGID="root" SGID="root" > FSGID="root" type=PROCTITLE msg=audit(1574445211.897:28015): > proctitle="./test_verifier" type=BPF msg=audit(1574445211.897:28016): > prog-id=8103 event=LOAD > > type=SYSCALL msg=audit(1574445211.897:28016): arch=c000003e syscall=321 > success=yes exit=14 a0=5 a1=7fff09ac6b80 a2=78 a3=0 items=0 ppid=1408 > pid=9266 auid=1001 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 > fsgid=0 tty=pts0 ses=1 comm="test_verifier" > exe="/home/jolsa/linux/tools/testing/selftests/bpf/test_verifier" > subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 > key=(null)ARCH=x86_64 SYSCALL=bpf AUID="jolsa" UID="root" GID="root" > EUID="root" SUID="root" FSUID="root" EGID="root" SGID="root" > FSGID="root" type=PROCTITLE msg=audit(1574445211.897:28016): > proctitle="./test_verifier" type=BPF msg=audit(1574445211.897:28017): > prog-id=8103 event=UNLOAD There is some precedence in using "op=" instead of "event=" (an audit "event" is already a thing, using "event=" here might get confusing). I suppose if we are getting really nit-picky you might want to lower-case the LOAD/UNLOAD, but generally Steve cares more about these things than I do. For reference, we have a searchable database of fields here: * https://github.com/linux-audit/audit-documentation/blob/master/specs/field s/field-dictionary.csv