[PATCH v3 00/12] ima: Fix rule parsing bugs and extend KEXEC_CMDLINE rule support · Tyler Hicks <hidden> · 2020-07-09
[PATCH v3 01/12] ima: Have the LSM free its audit rule · Tyler Hicks <hidden> · 2020-07-09
Re: [PATCH v3 01/12] ima: Have the LSM free its audit rule · Nayna <hidden> · 2020-07-17
Re: [PATCH v3 01/12] ima: Have the LSM free its audit rule · Tyler Hicks <hidden> · 2020-07-17
Re: [PATCH v3 01/12] ima: Have the LSM free its audit rule · Mimi Zohar <zohar@linux.ibm.com> · 2020-07-19
[PATCH v3 02/12] ima: Free the entire rule when deleting a list of rules · Tyler Hicks <hidden> · 2020-07-09
[PATCH v3 03/12] ima: Free the entire rule if it fails to parse · Tyler Hicks <hidden> · 2020-07-09
[PATCH v3 04/12] ima: Fail rule parsing when buffer hook functions have an invalid action · Tyler Hicks <hidden> · 2020-07-09
[PATCH v3 06/12] ima: Fail rule parsing when the KEY_CHECK hook is combined with an invalid cond · Tyler Hicks <hidden> · 2020-07-09
Re: [PATCH v3 06/12] ima: Fail rule parsing when the KEY_CHECK hook is combined with an invalid cond · Nayna <hidden> · 2020-07-17
Re: [PATCH v3 06/12] ima: Fail rule parsing when the KEY_CHECK hook is combined with an invalid cond · Tyler Hicks <hidden> · 2020-07-17
Re: [PATCH v3 06/12] ima: Fail rule parsing when the KEY_CHECK hook is combined with an invalid cond · Tyler Hicks <hidden> · 2020-07-17
[PATCH v3 07/12] ima: Fail rule parsing when appraise_flag=blacklist is unsupportable · Tyler Hicks <hidden> · 2020-07-09
Re: [PATCH v3 07/12] ima: Fail rule parsing when appraise_flag=blacklist is unsupportable · Mimi Zohar <zohar@linux.ibm.com> · 2020-07-16
Re: [PATCH v3 07/12] ima: Fail rule parsing when appraise_flag=blacklist is unsupportable · Tyler Hicks <hidden> · 2020-07-16
[PATCH v3 10/12] ima: Move comprehensive rule validation checks out of the token parser · Tyler Hicks <hidden> · 2020-07-09
[PATCH v3 12/12] ima: Support additional conditionals in the KEXEC_CMDLINE hook function · Tyler Hicks <hidden> · 2020-07-09
[PATCH v3 09/12] ima: Use correct type for the args_p member of ima_rule_entry.lsm elements · Tyler Hicks <hidden> · 2020-07-09
[PATCH v3 11/12] ima: Use the common function to detect LSM conditionals in a rule · Tyler Hicks <hidden> · 2020-07-09
[PATCH v3 08/12] ima: Shallow copy the args_p member of ima_rule_entry.lsm elements · Tyler Hicks <hidden> · 2020-07-09
Re: [PATCH v3 08/12] ima: Shallow copy the args_p member of ima_rule_entry.lsm elements · Konsta Karsisto <hidden> · 2020-07-17
Re: [PATCH v3 08/12] ima: Shallow copy the args_p member of ima_rule_entry.lsm elements · Tyler Hicks <hidden> · 2020-07-17
[PATCH v3 05/12] ima: Fail rule parsing when the KEXEC_CMDLINE hook is combined with an invalid cond · Tyler Hicks <hidden> · 2020-07-09
Re: [PATCH v3 00/12] ima: Fix rule parsing bugs and extend KEXEC_CMDLINE rule support · Mimi Zohar <zohar@linux.ibm.com> · 2020-07-17
Re: [PATCH v3 00/12] ima: Fix rule parsing bugs and extend KEXEC_CMDLINE rule support · Tyler Hicks <hidden> · 2020-07-17
Re: [PATCH v3 00/12] ima: Fix rule parsing bugs and extend KEXEC_CMDLINE rule support · Mimi Zohar <zohar@linux.ibm.com> · 2020-07-20

Re: [PATCH v3 01/12] ima: Have the LSM free its audit rule

From: Mimi Zohar <zohar@linux.ibm.com>
Date: 2020-07-19 11:02:50
Also in: linux-integrity, lkml

On Fri, 2020-07-17 at 14:24 -0500, Tyler Hicks wrote:

On 2020-07-17 15:20:22, Nayna wrote:

quoted

On 7/9/20 2:19 AM, Tyler Hicks wrote:

quoted

Ask the LSM to free its audit rule rather than directly calling kfree().

Is it to be called audit rule or filter rule ?  Likewise in subject line.

gt
The security hooks call this "audit rule" but Mimi explained the
reasoning for IMA referring to this as an "audit filter" here:

 https://lore.kernel.org/lkml/1593466203.5085.62.camel@linux.ibm.com/ (local)

I would be fine with her renaming/rewording this patch, accordingly, in
next-integrity-testing.

Both here and "ima: AppArmor satisfies the audit rule requirements",
the subject is AppArmor/LSM, which do refer to the rules as "audit"
rules.  In the "ima: Rename internal audit rule functions" case, the
rule rename is internal to IMA.  Here it makes sense to replace
"audit" with "filter".  Tyler, I've gone ahead and made the change.

Mimi

`h`	back out one level
`j`	next message in thread
`k`	previous message in thread
`l`	drill in
`Esc`	close help / fold thread tree
`?`	toggle this help