Re: [PATCH V3] audit: normalize NETFILTER_PKT

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 2017-03-03 08:56, Paul Moore wrote:
> On Fri, Mar 3, 2017 at 8:22 AM, Florian Westphal <fw@xxxxxxxxx> wrote:
> > Paul Moore <paul@xxxxxxxxxxxxxx> wrote:
> >> On Fri, Mar 3, 2017 at 7:45 AM, Florian Westphal <fw@xxxxxxxxx> wrote:
> >> > Richard Guy Briggs <rgb@xxxxxxxxxx> wrote:
> >> >> > Perhaps I'm missing something here, but let me ask again, how does
> >> >> > userspace distinguish between an unset nfmark and a nfmark of
> >> >> > 0xffffffff?
> >> >>
> >> >> It can't.
> >> >
> >> > It can if you log it as 0, as I asked in patch 1 review.
> >> >
> >> > (You wouldn't log sk uid of 0 as -1 either, would you?)
> >>
> >> I want to see the code able to handle the full range of nfmark values
> >> as well as the unset case; if that means we need to tweak userspace a
> >> bit, please work with Steve on that.
> >
> > There is no 'unset nfmark'.  Its just a 32bit integer.
> 
> Yes, my apologies, this thread has dragged on so long I muddled the
> details in my mind ... here is what I'm trying to get at, Richard's
> latest patch (unless I've missed one in my inbox) has the following
> line:
> 
>   audit_log_format(ab, "mark=%#x", skb->mark ?: -1);
> 
> ... which I believe to be incorrect.  I was trying to lead Richard
> along to that same realization, but it would appear I'm not having
> much success, so to put it bluntly, here is what I want that line to
> look like:
> 
>   audit_log_format(ab, "mark=%#x", skb->mark);

Then just say that.  Given the arguments presented, I agree.  Done.

> paul moore

- RGB

--
Richard Guy Briggs <rgb@xxxxxxxxxx>
Kernel Security Engineering, Base Operating Systems, Red Hat
Remote, Ottawa, Canada
Voice: +1.647.777.2635, Internal: (81) 32635
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html



[Index of Archives]     [Netfitler Users]     [LARTC]     [Bugtraq]     [Yosemite Forum]

  Powered by Linux