From mboxrd@z Thu Jan  1 00:00:00 1970
From: Eric Paris <eparis-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
Subject: Re: [PATCH RFC 00/48] Add namespace support for audit
Date: Tue, 11 Jun 2013 09:49:57 -0400
Message-ID: <1370958597.29545.11.camel@localhost>
References: <1367893269-9308-1-git-send-email-gaofeng@cn.fujitsu.com>
	<519B3B4E.1070405@cn.fujitsu.com> <20130606215255.GA28978@tp>
	<20130606224710.GA30502@tp> <51B531CC.2020604@cn.fujitsu.com>
	<20130610212437.GA11940@austin.hallyn.com>
	<51B6BCBE.7060608@cn.fujitsu.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Return-path: <containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org>
In-Reply-To: <51B6BCBE.7060608-BthXqXjhjHXQFUHtdCDX3A@public.gmane.org>
List-Unsubscribe: <https://lists.linuxfoundation.org/mailman/options/containers>,
	<mailto:containers-request-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org?subject=unsubscribe>
List-Archive: <http://lists.linuxfoundation.org/pipermail/containers/>
List-Post: <mailto:containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org>
List-Help: <mailto:containers-request-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org?subject=help>
List-Subscribe: <https://lists.linuxfoundation.org/mailman/listinfo/containers>,
	<mailto:containers-request-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org?subject=subscribe>
Sender: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org
Errors-To: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org
To: Gao feng <gaofeng-BthXqXjhjHXQFUHtdCDX3A@public.gmane.org>
Cc: containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org, Serge Hallyn <serge.hallyn-GeWIH/nMZzLQT0dZR+AlfA@public.gmane.org>, linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, linux-audit-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org, ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org, davem-fT/PcQaiUtIeIZ0/mPfg9Q@public.gmane.org
List-Id: linux-audit@redhat.com

On Tue, 2013-06-11 at 13:59 +0800, Gao feng wrote:
> On 06/11/2013 05:24 AM, Serge E. Hallyn wrote:
> > Quoting Gao feng (gaofeng-BthXqXjhjHXQFUHtdCDX3A@public.gmane.org):
> >> On 06/07/2013 06:47 AM, Serge Hallyn wrote:
> >>> Quoting Serge Hallyn (serge.hallyn-GeWIH/nMZzLQT0dZR+AlfA@public.gmane.org):
> >>>> Quoting Gao feng (gaofeng-BthXqXjhjHXQFUHtdCDX3A@public.gmane.org):
> >>>>> On 05/07/2013 10:20 AM, Gao feng wrote:

> In my option, the audit rules(inode, tree_list, filter) , some of audit
> controller related resources(enabled,pid,portid...) and skb queue, audit
> netlink sockets,kauditd thread should be per-userns. The audit user message
> which generated by the user in container should be per-userns too.
> 
> Since netns is not implemented as a hierarchy, and the network related
> resources are not global. so network related audit message should be per-userns too.
> 
> The security related audit message should be send to init user namespace
> as we discussed before. Maybe tty related audit message should be send
> to init user namespace too, I have no idea now.
> 
> The next step, I will post a new patchset which only make the audit user
> message and the basic audit resource per userns. I think this patchset
> will easy to be reviewed and accepted, And will not influence the host.
> This patchset contains the below patches:

I think this would be easier for us do from a certification and
doumentation PoV if we had an audit namespace, not tied to the user
namespace.  creating a new audit namespace should require
CAP_AUDIT_CONTROL in the user namespace which created the current audit
namespace.

Does that make sense?  I don't mind messages staying completely inside
the current namespace, but that means we can't give unpriv users (even
if they have priv in their user namespace) a new audit namespace...