From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: Separating Container(docker) Logs Date: Sat, 11 Mar 2017 13:31:15 -0500 Message-ID: <11460342.biKctF48Sg@x2> References: Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com Cc: Wajih Ul Hassan List-Id: linux-audit@redhat.com On Friday, March 10, 2017 11:47:06 PM EST Wajih Ul Hassan wrote: > I have been using Linux Audit Module for a while now especially in the > context of container(docker) environment. I use SELinux MCS labels with > docker --selinux-enabled to separate different container logs in auditd log > stream. But this solution is very limited to SELinux enabled OS and cannot > be ported to other systems like Ubuntu which uses AppArmour. So I am > looking for some other way to separate each container logs in auditd log > stream. If somebody can give me pointers or patches that makes > auditd container aware it will be really helpful for me. This is slowly being pulled together. This has to be done with common criteria (CC) certifications in mind since pci-dss, STIG, various contracting language all call out for or assume a common criteria certification. The first step in this direction was in pulling together a specification for container management events based on the virtualization protection profile. https://github.com/linux-audit/audit-documentation/wiki/SPEC-Virtualization-Manager-Guest-Lifecycle-Events The next step is to define what a container is and the use cases. From that we can advance the specification for auditing as it relates to containers. We will be digging into this soon. We can't really press forward without understanding all the certification requirements and this may even take some committee work to iron out the CC requirements. I'd hate to do something and then find out it doesn't meet requirements and undo and redo how it works. That would be too much disruption for utilities that might process the information. So, I think the answer for right now is you have to use labels. But this will get addressed in the coming months. -Steve