public inbox for linux-kernel@vger.kernel.org
 help / color / mirror / Atom feed
From: Gao feng <gaofeng@cn.fujitsu.com>
To: Gao feng <gaofeng@cn.fujitsu.com>,
	linux-kernel@vger.kernel.org, linux-audit@redhat.com
Cc: containers@lists.linux-foundation.org, ebiederm@xmission.com,
	serge.hallyn@ubuntu.com, eparis@redhat.com, sgrubb@redhat.com,
	Richard Guy Briggs <rgb@redhat.com>
Subject: Re: [RFC Part1 PATCH 00/20 v2] Add namespace support for audit
Date: Wed, 04 Dec 2013 16:31:51 +0800	[thread overview]
Message-ID: <529EE877.7030701@cn.fujitsu.com> (raw)
In-Reply-To: <1382599925-25143-1-git-send-email-gaofeng@cn.fujitsu.com>

Hi

On 10/24/2013 03:31 PM, Gao feng wrote:
> Here is the v1 patchset: http://lwn.net/Articles/549546/
> 
> The main target of this patchset is allowing user in audit
> namespace to generate the USER_MSG type of audit message,
> some userspace tools need to generate audit message, or
> these tools will broken.
> 

I really need this feature, right now,some process such as
logind are broken in container becase we leak of this feature.

> And the login process in container may want to setup
> /proc/<pid>/loginuid, right now this value is unalterable
> once it being set. this will also broke the login problem
> in container. After this patchset, we can reset this loginuid
> to zero if task is running in a new audit namespace.
> 

I notice this problem has been fixed in audit tree, so may be
I don't need to clean up loginuid when we create audit namespace.

And in audit tree, audit socket is per net namespace, hmm, I want
to know if anybody has a solution to allow processes to generate
USER_MSG type of audit message in un init pid/user namepsace.

Any idea? Eric,Steve,Richard?

Thanks
Gao

  parent reply	other threads:[~2013-12-04  8:39 UTC|newest]

Thread overview: 50+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2013-10-24  7:31 [RFC Part1 PATCH 00/20 v2] Add namespace support for audit Gao feng
2013-10-24  7:31 ` [PATCH 01/20] Audit: make audit netlink socket net namespace unaware Gao feng
2013-10-24  7:31 ` [PATCH 02/20] audit: introduce configure option CONFIG_AUDIT_NS Gao feng
2013-10-24  7:31 ` [PATCH 03/20] audit: make audit_skb_queue per audit namespace Gao feng
2013-10-24  7:31 ` [PATCH 04/20] audit: make audit_skb_hold_queue " Gao feng
2013-10-24  7:31 ` [PATCH 05/20] audit: make audit_pid " Gao feng
2013-10-24  7:31 ` [PATCH 06/20] audit: make kauditd_task " Gao feng
2013-10-24  7:31 ` [PATCH 07/20] aduit: make audit_nlk_portid " Gao feng
2013-10-24  7:31 ` [PATCH 08/20] audit: make kaudit_wait queue " Gao feng
2013-10-24  7:31 ` [PATCH 09/20] audit: make audit_backlog_wait " Gao feng
2013-10-24  7:31 ` [PATCH 10/20] audit: allow un-init audit ns to change pid and portid only Gao feng
2013-10-24  7:31 ` [PATCH 11/20] audit: use proper audit namespace in audit_receive_msg Gao feng
2013-10-24  7:31 ` [PATCH 12/20] audit: use proper audit_namespace in kauditd_thread Gao feng
2013-10-24  7:31 ` [PATCH 13/20] audit: introduce new audit logging interface for audit namespace Gao feng
2013-10-24  7:31 ` [PATCH 14/20] audit: pass proper audit namespace to audit_log_common_recv_msg Gao feng
2013-10-24  7:32 ` [PATCH 15/20] audit: Log audit pid config change in audit namespace Gao feng
2013-10-24  7:32 ` [PATCH 16/20] audit: allow GET,SET,USER MSG operations " Gao feng
2013-12-06 22:00   ` [PATCH 16/20] audit: allow GET, SET, USER " Serge E. Hallyn
2013-12-09  1:47     ` Gao feng
2013-10-24  7:32 ` [PATCH 17/20] nsproxy: don't make create_new_namespaces static Gao feng
2013-10-24  7:32 ` [PATCH 18/20] audit: add new message type AUDIT_CREATE_NS Gao feng
2013-12-06 22:10   ` Serge E. Hallyn
2013-12-09  1:59     ` Gao feng
2013-12-09 17:53       ` Serge Hallyn
2013-12-10  5:34         ` Gao feng
2013-10-24  7:32 ` [PATCH 19/20] audit: make audit_backlog_limit per audit namespace Gao feng
2013-10-24  7:32 ` [PATCH 20/20] audit: introduce /proc/<pid>/audit_backlog_limit Gao feng
2013-10-31  3:52 ` [RFC Part1 PATCH 00/20 v2] Add namespace support for audit Gao feng
2013-11-05  7:51   ` Gao feng
2013-11-05  7:52     ` Gao feng
2013-11-05  8:11       ` Li Zefan
2013-11-05  8:56         ` Gao feng
2013-11-05 19:14           ` Richard Guy Briggs
2013-11-07  5:51             ` Gao feng
2013-11-21  7:57             ` Gao feng
2013-12-04  8:31 ` Gao feng [this message]
2013-12-06 22:12   ` Serge E. Hallyn
2013-12-09  2:06     ` Gao feng
2013-12-09 18:26       ` Serge Hallyn
2013-12-10  8:16         ` Gao feng
2013-12-10 16:51           ` Serge Hallyn
2013-12-10 19:50             ` Eric Paris
2013-12-10 20:36               ` Serge E. Hallyn
2013-12-16  3:39                 ` Gao feng
2013-12-20 21:15                   ` Serge E. Hallyn
2013-12-24  9:32                     ` Gao feng
2013-12-06 21:31 ` Serge E. Hallyn
2013-12-09  2:29   ` Gao feng
2013-12-23 23:47     ` Richard Guy Briggs
2013-12-24  9:53       ` Gao feng

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=529EE877.7030701@cn.fujitsu.com \
    --to=gaofeng@cn.fujitsu.com \
    --cc=containers@lists.linux-foundation.org \
    --cc=ebiederm@xmission.com \
    --cc=eparis@redhat.com \
    --cc=linux-audit@redhat.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=rgb@redhat.com \
    --cc=serge.hallyn@ubuntu.com \
    --cc=sgrubb@redhat.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox