Hello, On Friday, November 22, 2019 4:19:55 PM EST Paul Moore wrote: > On Fri, Nov 22, 2019 at 2:24 PM Jiri Olsa <jolsa@xxxxxxxxxx> wrote: > > Paul, > > would following output be ok: > > > > type=SYSCALL msg=audit(1574445211.897:28015): arch=c000003e syscall=321 > > success=no exit=-13 a0=5 a1=7fff09ac6c60 a2=78 a3=6 items=0 ppid=1408 > > pid=9266 auid=1001 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 > > fsgid=0 tty=pts0 ses=1 comm="test_verifier" > > exe="/home/jolsa/linux/tools/testing/selftests/bpf/test_verifier" > > subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 > > key=(null)ARCH=x86_64 SYSCALL=bpf AUID="jolsa" UID="root" GID="root" > > EUID="root" SUID="root" FSUID="root" EGID="root" SGID="root" > > FSGID="root" type=PROCTITLE msg=audit(1574445211.897:28015): > > proctitle="./test_verifier" type=BPF msg=audit(1574445211.897:28016): > > prog-id=8103 event=LOAD > > > > type=SYSCALL msg=audit(1574445211.897:28016): arch=c000003e syscall=321 > > success=yes exit=14 a0=5 a1=7fff09ac6b80 a2=78 a3=0 items=0 ppid=1408 > > pid=9266 auid=1001 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 > > fsgid=0 tty=pts0 ses=1 comm="test_verifier" > > exe="/home/jolsa/linux/tools/testing/selftests/bpf/test_verifier" > > subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 > > key=(null)ARCH=x86_64 SYSCALL=bpf AUID="jolsa" UID="root" GID="root" > > EUID="root" SUID="root" FSUID="root" EGID="root" SGID="root" > > FSGID="root" type=PROCTITLE msg=audit(1574445211.897:28016): > > proctitle="./test_verifier" type=BPF msg=audit(1574445211.897:28017): > > prog-id=8103 event=UNLOAD > > There is some precedence in using "op=" instead of "event=" (an audit > "event" is already a thing, using "event=" here might get confusing). > I suppose if we are getting really nit-picky you might want to > lower-case the LOAD/UNLOAD, but generally Steve cares more about these > things than I do. > > For reference, we have a searchable database of fields here: > * > https://github.com/linux-audit/audit-documentation/blob/master/specs/field > s/field-dictionary.csv Paul's comments are correct. We generally use op for what operation is being performed. This approach looks better. This is fitting in with the audit way of doing things. I don't think there would be any user space issues adding support for the BPF record. -Steve
