From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: audit watch rules and docker containers Date: Mon, 5 Mar 2018 23:53:27 +0100 Message-ID: <20180305235327.1843aef2@ivy-bridge> References: <2039210969.8919376.1520042001277.ref@mail.yahoo.com> <2039210969.8919376.1520042001277@mail.yahoo.com> <1702143807.8978259.1520067124126@mail.yahoo.com> <20180304140043.718c3a58@ivy-bridge> <1356488798.9756685.1520219204924@mail.yahoo.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <1356488798.9756685.1520219204924@mail.yahoo.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Rakesh Cc: "linux-audit@redhat.com" List-Id: linux-audit@redhat.com On Mon, 5 Mar 2018 03:06:44 +0000 (UTC) Rakesh wrote: > Hi Steve, > Thanks for taking the time to look at it. I have been following the > conversation on adding container support to audit, however I am not > looking for container id in the event. I did some more tests and find > it works as expected for syscalls - -a always,exit -F arch=b64 -S > connect -F exit!=-ENOENT -F key=connect > > and the audit event in log is - > arch=c000003e syscall=42 success=yes exit=0 a0=1 a1=5562d1bb40f8 > a2=16 a3=7ffd9db76460 items=1 ppid=2 pid=60470 auid=4294967295 uid=0 > gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) > ses=4294967295 comm="systemd-cgroups" > exe="/lib/systemd/systemd-cgroups-agent" key="connect" > > Bit it's the watch events which are not working. Watches are a convenience that changes a human path into a device and inode. That is really what is watched. I think that if you have a watch on /etc/passwd, and a container has its own /etc/passwd, then you will have a different inode if not device. Hopefully this is being taken into account with the redesign or at least the ability to express that you want them all somehow. -Steve