On Wed, Dec 04, 2019 at 09:38:10AM -0500, Paul Moore wrote:

SNIP

quoted

+
+static const char * const bpf_audit_str[] = {
+       [BPF_AUDIT_LOAD]   = "LOAD",
+       [BPF_AUDIT_UNLOAD] = "UNLOAD",
+};
+
+static void bpf_audit_prog(const struct bpf_prog *prog, enum bpf_audit op)
+{
+       struct audit_context *ctx = NULL;
+       struct audit_buffer *ab;
+
+       if (audit_enabled == AUDIT_OFF)
+               return;
+       if (op == BPF_AUDIT_LOAD)
+               ctx = audit_context();
+       ab = audit_log_start(ctx, GFP_ATOMIC, AUDIT_BPF);
+       if (unlikely(!ab))
+               return;
+       audit_log_format(ab, "prog-id=%u op=%s",
+                        prog->aux->id, bpf_audit_str[op]);
+       audit_log_end(ab);
+}

As mentioned previously, I still think it might be a good idea to
ensure "op" is within the bounds of bpf_audit_str, but the audit bits
look reasonable to me.

ok, I'll add that, I'll send out full patch

thanks for the review,
jirka