Re: [PATCH 1/1] audit: Add new syscalls to the perm=w filter
On Mon, Oct 16, 2017 at 4:31 PM, Steve Grubb <sgrubb(a)redhat.com> wrote:
On Monday, October 16, 2017 3:10:59 PM EDT Paul Moore wrote:
> On Thu, Oct 12, 2017 at 11:24 PM, Steve Grubb <sgrubb(a)redhat.com> wrote:
> > The audit subsystem allows selecting audit events based on watches for
> > a particular behavior like writing to a file. A lot of syscalls have
> > been added without updating the list. This patch adds 2 syscalls to the
> > write filters: fallocate and renameat2.
> >
> > Signed-off-by: sgrubb <sgrubb(a)redhat.com>
> > ---
> >
> > include/asm-generic/audit_dir_write.h | 4 ++++
> > include/asm-generic/audit_write.h | 3 +++
> > 2 files changed, 7 insertions(+)
>
> FWIW, I expect that this syscall list is almost always going to be out
> of date; it's just the way this feature is designed. That doesn't
> mean I'm not going to merge fixes, I just want to make sure
> expectations are set accordingly.
I understand...but we are years behind. I just wanted to close the gap on a
couple obvious syscalls since everyone else is busy with more important bugs.
No worries, I'm perfectly fine with chipping away at things, I just
wanted to make sure that people aren't expecting this to be current.
The way it's designed I can almost guarantee it will always lag.
> I don't really care either way, this just struck me as odd
and I want to
> make sure you have a good reason (hint: add it to the patch
> description).
Understandable. But its close enough to ftruncate that I think it qualifies.
That's fine, I didn't feel very strongly about it either way. I'll
merge this tomorrow when I'm back in front of the system with my audit
kernel repo.
--
paul moore
www.paul-moore.com