On Friday 14 August 2009 10:51:41 am Stephen Smalley wrote: > BTW, it looks to my untrained eye as if dump_common_audit_data() allows > one to pass a separate target task in the union, in which case we'll get > two sets of pid= and comm= data in the same record, one for the subject > and one for the target/object. It appears that Smack is already using > that facility for things like ptrace, kill, etc, whereas SELinux is not. They should not be doing that. When another process is the object, we have specific auxiliary audit records to record this. We have to do this for CAPP so MAC systems should not have to do this. See AUDIT_OBJ_PID. > Two questions: > 1) Will the multiple pid= comm= entries get handled correctly by auditd > and the audit tools? Do we need separate names for the target vs source > pid/comm values? Yes, we need to record the object information. But we have a record type for that already AUDIT_OBJ_PID. > 2) Should we start using ad.u.tsk in SELinux as well to capture the > target of a ptrace, kill, wait, ... in the avc audit record? It should be captured. I thought it was for the LSPP work we did. If for some reason its not recorded, then audit_log_pid_context() should be called. -Steve -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with the words "unsubscribe selinux" without quotes as the message.
