Re: [PATCH ghak59 V3 0/4] audit: config_change normalizations and event record gathering

[Paul Moore]

On Tue, Dec 11, 2018 at 5:41 PM Richard Guy Briggs <rgb@xxxxxxxxxx> wrote:
> On 2018-12-11 17:31, Paul Moore wrote:
> > On Mon, Dec 10, 2018 at 5:18 PM Richard Guy Briggs <rgb@xxxxxxxxxx> wrote:

...

> > > Richard Guy Briggs (4):
> > >   audit: give a clue what CONFIG_CHANGE op was involved
> > >   audit: add syscall information to CONFIG_CHANGE records
> > >   audit: hand taken context to audit_kill_trees for syscall logging
> > >   audit: extend config_change mark/watch/tree rule changes
> > >
> > >  kernel/audit.c          | 33 +++++++++++++++++++++++----------
> > >  kernel/audit.h          |  4 ++--
> > >  kernel/audit_fsnotify.c |  4 ++--
> > >  kernel/audit_tree.c     | 28 +++++++++++++++-------------
> > >  kernel/audit_watch.c    |  8 +++++---
> > >  kernel/auditfilter.c    |  2 +-
> > >  kernel/auditsc.c        | 12 ++++++------
> > >  7 files changed, 54 insertions(+), 37 deletions(-)
> >
> > In order to make sure expectations are set appropriately, as we are at
> > -rc6 right now this is not something that would go into audit/next now
> > (assuming everything looks okay on review), it would go into
> > audit/next *after* the upcoming merge window.
>
> I agree it is a bit late for this.  I wasn't expecting it to go in this
> one.  I'm filling the queue since I'm blocked on other review for
> ghak81(5.5wks), ghak90(5.5wks), ghak100(3.5wks).  ghak90 missed another
> merge window.

As discussed previously, GHAK81
(https://github.com/linux-audit/audit-kernel/issues/81) is something
that I consider part of the audit container ID work (GHAK90).  I
believe it's time to stop treating it as a separate issue.

The audit container ID work, GHAK90
(https://github.com/linux-audit/audit-kernel/issues/90), is where all
the dragon's lie.  That one takes a good deal of time to review, and
quite frankly I'm really the only one who seems to be looking at it
anymore, so it takes a bit longer.

Beside the fact that GHAK100
(https://github.com/linux-audit/audit-kernel/issues/100) was marked as
a RFC, I've been waiting to hear back from the VFS folks if they are
comfortable with it.  Miklos Szeredi in particular had some concerns
and it isn't clear to me from that thread that his concerns have been
resolved.

-- 
paul moore
www.paul-moore.com