3:13 p.m.
There were two trivial hunk failures, so I've just attached the clean
non-copied patch to this message.
--
- Timothy R. Chavez
5:14 a.m.
On Mon, 2005-03-07 at 15:13 -0600, Timothy R. Chavez wrote:
@@ -106,6 +118,7 @@ struct audit_message {
struct audit_status {
__u32 mask; /* Bit mask for valid entries */
__u32 enabled; /* 1 = enabled, 0 = disbaled */
+ __u32 fs_enabled; /* 1 = fs auditing on, 0 = off */
Putting this in the middle of the structure breaks binary compatibility
with existing audit userspace. I'll shift it to the end.
--
dwmw2
8:15 a.m.
On Tuesday 08 March 2005 06:14, David Woodhouse wrote:
Putting this in the middle of the structure breaks binary
compatibility
with existing audit userspace. I'll shift it to the end.
This is important because the user space tools use glibc-kernheaders' version
of audit.h. If the offset changes for data elements that are known to
userspace, bad things happen.
I am wondering if a audit_status size comparison needs to be done upon
receipt? The userspace tool sends the size like this:
req.nlh.nlmsg_len = NLMSG_ALIGN(req.nlh.nlmsg_len) + NLMSG_SPACE(size);
where size comes from sizeof(struct audit_status)
In the kernel, the check is done like this in audit.c line 367:
if (nlh->nlmsg_len < sizeof(struct audit_status))
return -EINVAL
Shouldn't the check be something more like:
if (nlh->nlmsg_len != sizeof(struct audit_status)+NLMSG_ALIGN(0))
return -EINVAL
If this is a bad idea, because in it may introduce breakage where older tools
don't work with newer kernels, maybe we can put a check in the status message
where it compares the size of the status struct sent vs, the size the kernel
knows and adds a message saying the userspace tools can't control new
functionality? I think the status message should tell the user they are out
of date.
-Steve
9:07 a.m.
On Tue, 08 Mar 2005 11:14:54 +0000, David Woodhouse <dwmw2(a)infradead.org> wrote:
On Mon, 2005-03-07 at 15:13 -0600, Timothy R. Chavez wrote:
> @@ -106,6 +118,7 @@ struct audit_message {
> struct audit_status {
> __u32 mask; /* Bit mask for valid entries */
> __u32 enabled; /* 1 = enabled, 0 = disbaled */
> + __u32 fs_enabled; /* 1 = fs auditing on, 0 = off */
Putting this in the middle of the structure breaks binary compatibility
with existing audit userspace. I'll shift it to the end.
--
dwmw2
Ah yes, good point. Thanks
--
- Timothy R. Chavez
9:27 a.m.
On Tue, 2005-03-08 at 09:07 -0600, Timothy R. Chavez wrote:
> Putting this in the middle of the structure breaks binary
compatibility
> with existing audit userspace. I'll shift it to the end.
>
Ah yes, good point. Thanks
I have done so in the 2.6.9-5.0.3.EL.audit.10 package which is now in
the yum repository. That package also contains the '#5 U2' version of
your file system auditing code. Unfortunately it lacks the third attempt
at catching rdev,uid,gid correctly in audit_inode() -- I'm building an
audit.11 kernel now with that in, but I wanted to put the audit.10
kernel out there as soon as possible because the binary incompatibility
is holding Steve up with newer auditd code.
--
dwmw2
2:44 p.m.
On Tuesday 08 March 2005 10:27, David Woodhouse wrote:
I'm building an audit.11 kernel now with that in, but I wanted to
put
the audit.10 kernel out there as soon as possible because the
binary incompatibility is holding Steve up with newer auditd code.
The .11 kernel works fine. I'll release the next audit daemon in a few
minutes.
-Steve
7228
days inactive
7229
days old
linux-audit@lists.linux-audit.osci.io
5 comments
3 participants
participants (3)
-
David Woodhouse -
Steve Grubb -
Timothy R. Chavez