From mboxrd@z Thu Jan  1 00:00:00 1970
From: Richard Guy Briggs <rgb@redhat.com>
Subject: Re: Is zero a valid value for the pid member of the
	AUDIT_SIGNAL_INFO message?
Date: Wed, 12 Mar 2014 14:21:15 -0400
Message-ID: <20140312182115.GA27244@madcap2.tricolour.ca>
References: <20140311221517.GA15334@madcap2.tricolour.ca>
	<3280036.UE6vvtA28r@x2>
	<1394642105.31201.2.camel@flatline.rdu.redhat.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
Content-Disposition: inline
In-Reply-To: <1394642105.31201.2.camel@flatline.rdu.redhat.com>
List-Unsubscribe: <https://www.redhat.com/mailman/options/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: Eric Paris <eparis@redhat.com>
Cc: linux-audit@redhat.com
List-Id: linux-audit@redhat.com

On 14/03/12, Eric Paris wrote:
> On Wed, 2014-03-12 at 08:22 -0400, Steve Grubb wrote:
> > On Tuesday, March 11, 2014 06:15:17 PM Richard Guy Briggs wrote:
> > > Is zero a valid value for the pid member of the AUDIT_SIGNAL_INFO message?
> > 
> > Well, pid=0 would be the kernel. So, its valid but unlikely.
> 
> Actually, signals from the kernel will never get recorded here...
> 
> > Offhand I don't 
> > know why the kernel might try sending a signal. Is this a problem?
> 
> He's trying to figure out how to store this info in light of pid
> namespaces.  right now, auditd can only live in the initial pid
> namespace, so can only get signals from processes in the initial pid
> namespace, so we can store it as a number always in the initial pid
> namespace.  But if auditd were ever to not be in the initial pid
> namespace, not sure what to do....

Nice word column alignment above there Eric...  ;-)

I would be inclined to always store it in the initial pid namespace and
then make a decision if it translates sanely when needed to the auditd
namespace(s).

> > -Steve

- RGB

--
Richard Guy Briggs <rbriggs@redhat.com>
Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, Red Hat
Remote, Ottawa, Canada
Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545