From mboxrd@z Thu Jan 1 00:00:00 1970 From: Mimi Zohar Subject: Re: [RFC PATCH V1 00/12] audit: implement container id Date: Mon, 05 Mar 2018 08:27:39 -0500 Message-ID: <1520256459.10396.283.camel@linux.vnet.ibm.com> References: <1520200557.10396.257.camel@linux.vnet.ibm.com> <20180305033128.6sqreoo5olqwq5og@madcap2.tricolour.ca> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Return-path: In-Reply-To: <20180305033128.6sqreoo5olqwq5og-bcJWsdo4jJjeVoXN4CMphl7TgLCtbB0G@public.gmane.org> List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org Errors-To: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org To: Richard Guy Briggs Cc: mszeredi-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org, trondmy-7I+n7zu2hftEKMMhf/gKZA@public.gmane.org, luto-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org, jlayton-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org, carlos-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org, linux-api-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org, LKML , eparis-FjpueFixGhCM4zKIHC2jIg@public.gmane.org, dhowells-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org, Linux-Audit Mailing List , ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org, simo-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org, netdev-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, linux-fsdevel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, cgroups-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, viro-RmSDqhL/yNMiFSDQTTA3OLVCufUGDwFn@public.gmane.org T24gU3VuLCAyMDE4LTAzLTA0IGF0IDIyOjMxIC0wNTAwLCBSaWNoYXJkIEd1eSBCcmlnZ3Mgd3Jv dGU6Cj4gT24gMjAxOC0wMy0wNCAxNjo1NSwgTWltaSBab2hhciB3cm90ZToKPiA+IE9uIFRodSwg MjAxOC0wMy0wMSBhdCAxNDo0MSAtMDUwMCwgUmljaGFyZCBHdXkgQnJpZ2dzIHdyb3RlOgo+ID4g PiBJbXBsZW1lbnQgYXVkaXQga2VybmVsIGNvbnRhaW5lciBJRC4KPiA+ID4gCj4gPiA+IFRoaXMg cGF0Y2hzZXQgaXMgYSBwcmVsaW1pbmFyeSBSRkMgYmFzZWQgb24gdGhlIHByb3Bvc2FsIGRvY3Vt ZW50IChWMykKPiA+ID4gcG9zdGVkOgo+ID4gPiAJaHR0cHM6Ly93d3cucmVkaGF0LmNvbS9hcmNo aXZlcy9saW51eC1hdWRpdC8yMDE4LUphbnVhcnkvbXNnMDAwMTQuaHRtbAo+ID4gPiAKPiA+ID4g VGhlIGZpcnN0IHBhdGNoIGltcGxlbWVudHMgdGhlIHByb2MgZnMgd3JpdGUgdG8gc2V0IHRoZSBh dWRpdCBjb250YWluZXIKPiA+ID4gSUQgb2YgYSBwcm9jZXNzLCBlbWl0dGluZyBhbiBBVURJVF9D T05UQUlORVIgcmVjb3JkLgo+ID4gPiAKPiA+ID4gVGhlIHNlY29uZCBpbXBsZW1lbnRzIGFuIGF1 eGlsaWFyeSBzeXNjYWxsIHJlY29yZCBBVURJVF9DT05UQUlORVJfSU5GTwo+ID4gPiBpZiBhIGNv bnRhaW5lciBJRCBpcyBwcmVzZW50IG9uIGEgdGFzay4KPiA+ID4gCj4gPiA+IFRoZSB0aGlyZCBh ZGRzIGZpbHRlcmluZyB0byB0aGUgZXhpdCwgZXhjbHVkZSBhbmQgdXNlciBsaXN0cy4KPiA+ID4g Cj4gPiA+IFRoZSA0dGgsIGltcGxlbWVudHMgcmVhZGluZyB0aGUgY29udGFpbmVyIElEIGZyb20g dGhlIHByb2MgZmlsZXN5c3RlbQo+ID4gPiBmb3IgZGVidWdnaW5nLiAgVGhpcyBpc24ndCBwbGFu bmVkIGZvciB1cHN0cmVhbSBpbmNsdXNpb24uCj4gPiA+IAo+ID4gPiBUaGUgNXRoIGFkZHMgc2ln bmFsIGFuZCBwdHJhY2Ugc3VwcG9ydC4KPiA+ID4gCj4gPiA+IFRoZSA2dGggYXR0ZW1wdHMgdG8g Y3JlYXRlIGEgbG9jYWwgYXVkaXQgY29udGV4dCB0byBiZSBhYmxlIHRvIGJpbmQgYQo+ID4gPiBz dGFuZGFsb25lIHJlY29yZCB3aXRoIHRoZSBjb250YWluZXIgSUQgcmVjb3JkLgo+ID4gPiAKPiA+ ID4gVGhlIDd0aCwgOHRoLCA5dGgsIDEwdGggcGF0Y2hlcyBhZGQgY29udGFpbmVyIElEIHJlY29y ZHMgdG8gc3RhbmRhbG9uZQo+ID4gPiByZWNvcmRzLiAgU29tZSBvZiB0aGVzZSBtYXkgZW5kIHVw IGJlaW5nIHN5c2NhbGwgYXV4aWxpYXJ5IHJlY29yZHMgYW5kCj4gPiA+IHdvbid0IG5lZWQgdGhp cyBzcGVjaWZpYyBzdXBwb3J0IHNpbmNlIHRoZXknbGwgYmUgc3VwcG9ydGVkIHZpYQo+ID4gPiBz eXNjYWxscy4KPiA+ID4gCj4gPiA+IFRoZSAxMXRoIGlzIGEgdGVtcG9yYXJ5IHdvcmthcm91bmQg ZHVlIHRvIHRoZSBBVURJVF9DT05UQUlORVIgcmVjb3Jkcwo+ID4gPiBub3Qgc2hvd2luZyB1cCBh cyBkbyBBVURJVF9MT0dJTiByZWNvcmRzLiAgSSBzdXNwZWN0IHRoaXMgaXMgZHVlIHRvIGl0cwo+ ID4gPiByYW5nZSAoMTAwMCB2cyAxMzAwKSwgYnV0IHRoZSBpbnRlbnQgaXMgdG8gc29sdmUgaXQu Cj4gPiA+IAo+ID4gPiBUaGUgMTJ0aCBhZGRzIGRlYnVnIGluZm9ybWF0aW9uIG5vdCBpbnRlbmRl ZCBmb3IgdXBzdHJlYW0gZm9yIHRob3NlCj4gPiA+IGJyYXZlIHNvdWxzIHdhbnRpbmcgdG8gdGlu a2VyIHdpdGggaXQgaW4gdGhpcyBlYXJseSBzdGF0ZS4KPiA+ID4gCj4gPiA+IEZlZWRiYWNrIHBs ZWFzZSEKPiA+IAo+ID4gV2hpY2ggdHJlZSBjYW4gdGhpcyBwYXRjaCBzZXQgYmUgYXBwbGllZCB0 bz8KPiAKPiBnaXQ6Ly9naXQua2VybmVsLm9yZy9wdWIvc2NtL2xpbnV4L2tlcm5lbC9naXQvcGNt b29yZS9hdWRpdC5naXQgbmV4dAoKVGhhbmtzLCB0aGF0IHdvcmtlZC4gwqBJbiBjYXNlIGFueW9u ZSBlbHNlIGlzIHRyeWluZyB0byBhcHBseSB0aGVzZQpwYXRjaGVzIHRvIGEgNC4xNi4wLXJjIGJh c2VkIGtlcm5lbCwgY29tbWl0wqA0ZTdlM2FkYmJhNTIgKCJFeHBhbmQKdmFyaW91cyBJTklUXyog bWFjcm9zIGFuZCByZW1vdmUiKSBtb3ZlZCAuc2Vzc2lvbmlkCnRvwqBpbml0L2luaXRfdGFzay5j LgoKTWltaQoKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18K Q29udGFpbmVycyBtYWlsaW5nIGxpc3QKQ29udGFpbmVyc0BsaXN0cy5saW51eC1mb3VuZGF0aW9u Lm9yZwpodHRwczovL2xpc3RzLmxpbnV4Zm91bmRhdGlvbi5vcmcvbWFpbG1hbi9saXN0aW5mby9j b250YWluZXJz From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]:54952 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S935104AbeCEN1w (ORCPT ); Mon, 5 Mar 2018 08:27:52 -0500 Received: from pps.filterd (m0098419.ppops.net [127.0.0.1]) by mx0b-001b2d01.pphosted.com (8.16.0.22/8.16.0.22) with SMTP id w25DOel5087809 for ; Mon, 5 Mar 2018 08:27:52 -0500 Received: from e06smtp11.uk.ibm.com (e06smtp11.uk.ibm.com [195.75.94.107]) by mx0b-001b2d01.pphosted.com with ESMTP id 2gh5gmknxf-1 (version=TLSv1.2 cipher=AES256-SHA256 bits=256 verify=NOT) for ; Mon, 05 Mar 2018 08:27:51 -0500 Received: from localhost by e06smtp11.uk.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Mon, 5 Mar 2018 13:27:49 -0000 Subject: Re: [RFC PATCH V1 00/12] audit: implement container id From: Mimi Zohar To: Richard Guy Briggs Cc: cgroups@vger.kernel.org, containers@lists.linux-foundation.org, linux-api@vger.kernel.org, Linux-Audit Mailing List , linux-fsdevel@vger.kernel.org, LKML , netdev@vger.kernel.org, mszeredi@redhat.com, ebiederm@xmission.com, simo@redhat.com, jlayton@redhat.com, carlos@redhat.com, dhowells@redhat.com, viro@zeniv.linux.org.uk, luto@kernel.org, eparis@parisplace.org, trondmy@primarydata.com, serge@hallyn.com Date: Mon, 05 Mar 2018 08:27:39 -0500 In-Reply-To: <20180305033128.6sqreoo5olqwq5og@madcap2.tricolour.ca> References: <1520200557.10396.257.camel@linux.vnet.ibm.com> <20180305033128.6sqreoo5olqwq5og@madcap2.tricolour.ca> Content-Type: text/plain; charset="UTF-8" Mime-Version: 1.0 Content-Transfer-Encoding: 8bit Message-Id: <1520256459.10396.283.camel@linux.vnet.ibm.com> Sender: linux-fsdevel-owner@vger.kernel.org List-ID: On Sun, 2018-03-04 at 22:31 -0500, Richard Guy Briggs wrote: > On 2018-03-04 16:55, Mimi Zohar wrote: > > On Thu, 2018-03-01 at 14:41 -0500, Richard Guy Briggs wrote: > > > Implement audit kernel container ID. > > > > > > This patchset is a preliminary RFC based on the proposal document (V3) > > > posted: > > > https://www.redhat.com/archives/linux-audit/2018-January/msg00014.html > > > > > > The first patch implements the proc fs write to set the audit container > > > ID of a process, emitting an AUDIT_CONTAINER record. > > > > > > The second implements an auxiliary syscall record AUDIT_CONTAINER_INFO > > > if a container ID is present on a task. > > > > > > The third adds filtering to the exit, exclude and user lists. > > > > > > The 4th, implements reading the container ID from the proc filesystem > > > for debugging. This isn't planned for upstream inclusion. > > > > > > The 5th adds signal and ptrace support. > > > > > > The 6th attempts to create a local audit context to be able to bind a > > > standalone record with the container ID record. > > > > > > The 7th, 8th, 9th, 10th patches add container ID records to standalone > > > records. Some of these may end up being syscall auxiliary records and > > > won't need this specific support since they'll be supported via > > > syscalls. > > > > > > The 11th is a temporary workaround due to the AUDIT_CONTAINER records > > > not showing up as do AUDIT_LOGIN records. I suspect this is due to its > > > range (1000 vs 1300), but the intent is to solve it. > > > > > > The 12th adds debug information not intended for upstream for those > > > brave souls wanting to tinker with it in this early state. > > > > > > Feedback please! > > > > Which tree can this patch set be applied to? > > git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit.git next Thanks, that worked.  In case anyone else is trying to apply these patches to a 4.16.0-rc based kernel, commit 4e7e3adbba52 ("Expand various INIT_* macros and remove") moved .sessionid to init/init_task.c. Mimi