util/audit: Correct usage of audit logging functions #388
Conversation
Update util_audit_log to use audit_log_user_message for UTIL_AUDIT_TYPE_POLICYLOAD and UTIL_AUDIT_TYPE_MAC_STATUS, and audit_log_user_avc_message for UTIL_AUDIT_TYPE_AVC. The result parameter is now passed to audit_log_user_message, set to 1 by default. This change ensures proper argument order for ausearch utility as discussed in linux-audit/audit-userspace#394.
| r = audit_log_user_avc_message(audit_fd, audit_type, message, NULL, NULL, NULL, uid); | ||
| } else { | ||
| r = audit_log_user_message(audit_fd, audit_type, message, NULL, NULL, NULL, 1); | ||
| } |
There was a problem hiding this comment.
Why are there two functions exposed by libaudit, anyway? Why doesn't audit_log_user_avc_message() just check whether the passed type is other than AUDIT_USER_AVC (or related AVC types), and then forward to audit_log_user_message()?
There was a problem hiding this comment.
Perfectly valid question, I believe it's for historical reasons. The implementation of both functions is very similar but they provide a slightly different output. Documentation says:
- audit_log_user_avc_message This function should be used by all apps that are SELinux object managers.
- audit_log_user_message This function should be used by all console apps that do not manipulate accounts or groups.
There was a problem hiding this comment.
Btw., can you elaborate on the last argument to audit_log_user_message? The man-page is not very helpful. I guess this is about whether this is an audit-message about a successful / expected operation, or whether this is about a failed / unexpected operation?
I think passing 1 unconditionally might not be right here, though.
Update util_audit_log to use audit_log_user_message for UTIL_AUDIT_TYPE_POLICYLOAD and UTIL_AUDIT_TYPE_MAC_STATUS, and audit_log_user_avc_message for UTIL_AUDIT_TYPE_AVC. The result parameter is now passed to audit_log_user_message, set to 1 by default.
This change ensures proper argument order for ausearch utility as discussed in linux-audit/audit-userspace#394.
Fixes #387