From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Serge E. Hallyn" Subject: Re: [PATCH V5 09/13] fork: audit on creation of new namespace(s) Date: Mon, 13 Oct 2014 15:14:54 +0200 Message-ID: <20141013131454.GG24703@mail.hallyn.com> References: Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Content-Disposition: inline In-Reply-To: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org Errors-To: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org To: Richard Guy Briggs Cc: aviro-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org, containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org, linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, eparis-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org, pmoore-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org, linux-audit-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org, sgrubb-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org, ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org List-Id: linux-audit@redhat.com Quoting Richard Guy Briggs (rgb-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org): > When clone(2) is called to fork a new process creating one or more namespaces, > audit the event to tie the new pid with the namespace IDs. > > Signed-off-by: Richard Guy Briggs Acked-by: Serge Hallyn > --- > kernel/fork.c | 3 +++ > kernel/nsproxy.c | 1 + > 2 files changed, 4 insertions(+), 0 deletions(-) > > diff --git a/kernel/fork.c b/kernel/fork.c > index 6a13c46..a7fe4d5 100644 > --- a/kernel/fork.c > +++ b/kernel/fork.c > @@ -1624,6 +1624,9 @@ long do_fork(unsigned long clone_flags, > get_task_struct(p); > } > > + if (unlikely(clone_flags & CLONE_NEW_MASK)) { > + audit_log_ns_info(p); > + } > wake_up_new_task(p); > > /* forking complete and child started to run, tell ptracer */ > diff --git a/kernel/nsproxy.c b/kernel/nsproxy.c > index 0c2f25e..2cdc16b 100644 > --- a/kernel/nsproxy.c > +++ b/kernel/nsproxy.c > @@ -25,6 +25,7 @@ > #include > #include > #include > +#include > > static struct kmem_cache *nsproxy_cachep; > > -- > 1.7.1