From mboxrd@z Thu Jan 1 00:00:00 1970 From: Paul Moore Subject: Re: [PATCH] audit: don't attempt to lookup PIDs when changing PID filtering audit rules Date: Mon, 15 Dec 2014 14:03:05 -0500 Message-ID: <2316741.ge35UybDDq@sifl> References: <20141215171414.30169.46068.stgit@localhost> <1418664592.3145.3.camel@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <1418664592.3145.3.camel@redhat.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Eric Paris Cc: rgb@redhat.com, linux-audit@redhat.com List-Id: linux-audit@redhat.com On Monday, December 15, 2014 12:29:52 PM Eric Paris wrote: > Lets say I and in the non-init pid namespace. > > I run audictl -a exit,always -S all -F pid=1 > > Is the audit system going to show records for what I think is pid=1 or > what the initial pid namespace thinks is pid=1 ? The initial namespace. If we want the executing task's current namespace we should probably change audit_filter_user_rules(). > Which is correct? (hint, it's impossible to know pids above my > namespace, or even to know what pid the process in question thinks it > is, since it could be below my namespace) Heh. I'm sorry, I tend to laugh when I hear the term "correct" during an audit discussion ;) Steve, Richard, Eric - what do you guys want: initial or current namespace? > I won't pretend this is easy to solve. > > Steve et al. What do you think of maybe having pid= rules automatically > removed when the pid goes away? I can't think of another way to handle > this (although the perf hit might be so stupidly high....) I'm personally not super excited about rules disappearing automatically and I also believe that it should be possible to remove a rule regardless (not being able to remove a PID filtering rule due to the status of the associated task is silly). -- paul moore security and virtualization @ redhat