Re: [RFC][PATCH] (#3) file system auditing

[Serge Hallyn <serue@us.ibm.com>]

On Thu, 2005-04-28 at 15:31 -0500, Timothy R. Chavez wrote:
> On Wed, 2005-04-27 at 00:28 +0100, Christoph Hellwig wrote:
> > On Tue, Apr 26, 2005 at 04:04:46PM -0500, Timothy R. Chavez wrote:
> > > Hello,
> > > 
> > > The audit subsystem is currently incapable of auditing a file system
> > > object based on its location and name.
> > 
> 
> Hello Christoph,
> 
> I apologize for the delay in my response.  Thank you for your response.
> I'll try to be succinct.
> 
> > Which doesn't make sense in our world of per-process namespaces.  

AFAICT, it does so long as we are trying to audit non-admin users.  I
may be in a different namespace from the admin, but so long only the
admin can mount over /etc, the auditing should still happen.  An admin
can mess us up by mounting /root/dummy/etc on top of /etc, but we expect
the admin to know what he is doing.

Note that this patch is not auditing based on full pathname.  It audits
based on the parent directory and filename.  So even if /etc is bind
mounted onto /mnt/root/etc, accessing /mnt/root/etc/passwd will still
trigger an audit entry.

Am I missing something?  How do namespaces mess this up?

thanks,
-serge

-- 
Serge Hallyn <serue@us.ibm.com>