[lkml]   [2019]   [Sep]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: Unmerged patches adding audit when protected_regular/fifos sysctl causes EACCES
On Wed, Sep 25, 2019 at 02:58:28PM -0400, Jérémie Galarneau wrote:
> Hi Kees,
> I have noticed that the two top-most patches of your protected-creat
> branch were never merged upstream [1]. Those patches add audit logs
> whenever the protected_regular or protected_fifo sysctl prevent the
> creation of a file/fifo.
> They were mentioned in the v4 thread [2] of the "main" patch and
> seemed acceptable, but they were no longer mentioned in v5 [3], which
> was merged.
> Now that systemd enables those sysctls by default (v241+), I got
> bitten pretty hard by this check and it took me a while to figure out
> what was happening [4]. I ended up catching it by adding a bunch of
> printk(), including where you proposed to add an audit log statement.
> I just found your two patches while implementing what you proposed almost 1:1.
> Was there a reason why those were abandoned? Otherwise, would you mind
> resubmitting them?


There was concern about getting buy-in from the audit folks delaying
things even more. Instead of waiting for that, as it had already taken
a long time to get consensus even on the functionality, they were

I'll rebase them and send them out again; thanks for the ping!


> Thanks!
> Jérémie
> [1]
> [2]
> [3]
> [4]
> --
> Jérémie Galarneau
> EfficiOS Inc.

Kees Cook

 \ /
  Last update: 2019-09-25 22:13    [W:0.072 / U:31.684 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site