From mboxrd@z Thu Jan 1 00:00:00 1970 From: Gao feng Subject: Re: [Part1 PATCH 00/22] Add namespace support for audit Date: Fri, 21 Jun 2013 13:15:46 +0800 Message-ID: <51C3E182.30902@cn.fujitsu.com> References: <1371606834-5802-1-git-send-email-gaofeng@cn.fujitsu.com> <20130619204927.GJ3212@redhat.com> <1371675095.16587.5.camel@dhcp137-13.rdu.redhat.com> <51C270AF.1080902@cn.fujitsu.com> <51C27266.3060909@cn.fujitsu.com> <87y5a4phlm.fsf@xmission.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <87y5a4phlm.fsf-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org Errors-To: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org To: "Eric W. Biederman" Cc: containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org, serge.hallyn-GeWIH/nMZzLQT0dZR+AlfA@public.gmane.org, linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, Eric Paris , linux-audit-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org, matthltc-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8@public.gmane.org, sgrubb-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org List-Id: containers.vger.kernel.org On 06/21/2013 06:01 AM, Eric W. Biederman wrote: > Gao feng writes: > >> On 06/20/2013 11:02 AM, Gao feng wrote: >>> If we don't tie audit to user namespace, there is still one problem. >> >> One more problem. some audit messages are generated by some net subsystem >> such as netfilter. If we don't tie audit to user namespace, we have no >> idea where these audit messages should go. there is no relationship between >> net namespace and audit namespace while we can get user namespace through >> net user namespace. > > I am in favor of the user namespace tie in. > > I am in favor of running a per user namespace audit filter once per user > namespace walking up the user namespace hierarchy. Each filter would > deliver messages to a different userspace audit daemon. > Agree, this sounds reasonable. > Until we agreement to go that far I am not certain the kernel generated > audit messages should go anywhere except to the global audit daemon. There are some audit messages that we sure where they should go, we can start from them firstly. > > I think on an individual basis we can look at kernel audit messages and > see if they should go to just the global user namespace. Just the user > namspace of the relevant network stack. Or if the message should go to > the audit daemon of every user namespace that is an ancestor of some > starting user namespace. > > But please let's error on the side of caution here. > > Eric > -- > To unsubscribe from this list: send the line "unsubscribe linux-kernel" in > the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org > More majordomo info at http://vger.kernel.org/majordomo-info.html > Please read the FAQ at http://www.tux.org/lkml/ >