From mboxrd@z Thu Jan 1 00:00:00 1970 From: Casey Schaufler Subject: Re: RFC(v2): Audit Kernel Container IDs Date: Mon, 11 Dec 2017 08:52:43 -0800 Message-ID: <50813ebc-5de7-c930-79dc-c1d3cfcfb172@schaufler-ca.com> References: <20171012141359.saqdtnodwmbz33b2@madcap2.tricolour.ca> <75b7d6a6-42ba-2dff-1836-1091c7c024e7@schaufler-ca.com> <7ebca85a-425c-2b95-9a5f-59d81707339e@digikod.net> <1513009857.6310.337.camel@redhat.com> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1513011165; bh=se/ZlP3ovczS9qesFMAunBJI8RgTfaba3K/O9IUHKPQ=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From:Subject; b=gN2No3AxBBovD0Ehz8uSanMYGHkYmWhZqvoS8t/+/rKqERtMXJLHU/BUI2PE3/LchQ2whU8E52y6hz5sPvLhqSDLfhYATUugVhO73DZYNh+50M7Mt37zwq74UoJAufR7714KXD9DrE5n2WqcYihfH35KkiOHd8fC0WVNF7MWSNQnNcfBdF/gQERKpxfZtRASOZ/5MFItVvpJNfSKJGlSt3u3GPQof4mYHYuPnJy6GqvtSMnHQ+3Sh+/kbKg/ZYuZtNEGhO2KTVI10jhHM1MnHtUo9+LSUr73I1ElPR+pfYZs5w/N27PeHZ/RdPZcrd9baa4a+Vdza4Ud0sAIVVqSDg== In-Reply-To: <1513009857.6310.337.camel@redhat.com> Content-Language: en-US Sender: linux-kernel-owner@vger.kernel.org List-ID: Content-Type: text/plain; charset="us-ascii" To: Eric Paris , =?UTF-8?Q?Micka=c3=abl_Sala=c3=bcn?= , Richard Guy Briggs , cgroups@vger.kernel.org, Linux Containers , Linux API , Linux Audit , Linux FS Devel , Linux Kernel , Linux Network Development Cc: mszeredi@redhat.com, "Eric W. Biederman" , Simo Sorce , jlayton@redhat.com, Carlos O'Donell , David Howells , Al Viro , Andy Lutomirski , Eric Paris , trondmy@primarydata.com, Michael Kerrisk On 12/11/2017 8:30 AM, Eric Paris wrote: > On Sat, 2017-12-09 at 10:28 -0800, Casey Schaufler wrote: >> Because a container doesn't have to use namespaces to be a container >> you still need a mechanism for a process to declare that it is in >> fact >> in a container, and to identify the container. > I like the idea but I'm still tossing it around in my head (and > thinking about Casey's statement too). Lets say we have a 'docker-like' > container with pid=100 netns=X,userns=Y,mountns=Z. If I'm on the host > in all init namespaces and I run > nsenter -t 100 -n ip link set eth0 promisc on > How should this be logged? Did this command run in it's own 'container' > unrelated to the 'docker-like' container? Jose Bollo's PTAGS ( https://gitlab.com/jobol/ptags ) would be prefect. Any time you declare something to be a container or enter a namespace you slap a tag on it. Identifying nested containers would be easy, you'd have multiple tags. PTAGS unfortunately needs module stacking, but how hard could that be? > -Eric