Re: [PATCH] audit: don't attempt to lookup PIDs when changing PID filtering audit rules

[Paul Moore <pmoore@redhat.com>]

On Monday, December 15, 2014 12:29:52 PM Eric Paris wrote:
> Lets say I and in the non-init pid namespace.
> 
> I run audictl -a exit,always -S all -F pid=1
> 
> Is the audit system going to show records for what I think is pid=1 or
> what the initial pid namespace thinks is pid=1 ?

The initial namespace.  If we want the executing task's current namespace we 
should probably change audit_filter_user_rules().

> Which is correct? (hint, it's impossible to know pids above my
> namespace, or even to know what pid the process in question thinks it
> is, since it could be below my namespace)

Heh.  I'm sorry, I tend to laugh when I hear the term "correct" during an 
audit discussion ;)

Steve, Richard, Eric - what do you guys want: initial or current namespace?

> I won't pretend this is easy to solve.
> 
> Steve et al.  What do you think of maybe having pid= rules automatically
> removed when the pid goes away?  I can't think of another way to handle
> this (although the perf hit might be so stupidly high....)

I'm personally not super excited about rules disappearing automatically and I 
also believe that it should be possible to remove a rule regardless (not being 
able to remove a PID filtering rule due to the status of the associated task 
is silly).

-- 
paul moore
security and virtualization @ redhat