From: ebiederm@xmission.com (Eric W. Biederman)
To: Richard Guy Briggs <rgb@redhat.com>
Cc: cgroups@vger.kernel.org,
Linux Containers <containers@lists.linux-foundation.org>,
Linux API <linux-api@vger.kernel.org>,
Linux Audit <linux-audit@redhat.com>,
Linux FS Devel <linux-fsdevel@vger.kernel.org>,
Linux Kernel <linux-kernel@vger.kernel.org>,
Linux Network Development <netdev@vger.kernel.org>,
Aristeu Rozanski <arozansk@redhat.com>,
David Howells <dhowells@redhat.com>,
Eric Paris <eparis@parisplace.org>,
jlayton@redhat.com, Andy Lutomirski <luto@kernel.org>,
mszeredi@redhat.com, Paul Moore <pmoore@redhat.com>,
"Serge E. Hallyn" <serge@hallyn.com>,
Steve Grubb <sgrubb@redhat.com>,
trondmy@primarydata.com, Al Viro <viro@zeniv.linux.org.uk>
Subject: Re: RFC: Audit Kernel Container IDs
Date: Thu, 14 Sep 2017 12:33:06 -0500 [thread overview]
Message-ID: <87d16tb2y5.fsf@xmission.com> (raw)
In-Reply-To: <20170913171328.GP3405@madcap2.tricolour.ca> (Richard Guy Briggs's message of "Wed, 13 Sep 2017 13:13:28 -0400")
Richard Guy Briggs <rgb@redhat.com> writes:
> The trigger is a pseudo filesystem (proc, since PID tree already exists)
> write of a u64 representing the container ID to a file representing a
> process that will become the first process in a new container.
> This might place restrictions on mount namespaces required to define a
> container, or at least careful checking of namespaces in the kernel to
> verify permissions of the orchestrator so it can't change its own
> container ID.
Why a u64?
Why a proc filesystem write and not a magic audit message?
I don't like the fact that the proc filesystem entry is likely going to
be readable and abusable by non-audit contexts?
Why the ability to change the containerid? What is the use case you are
thinking of there?
Eric
next prev parent reply other threads:[~2017-09-14 17:33 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-09-13 17:13 RFC: Audit Kernel Container IDs Richard Guy Briggs
2017-09-13 19:33 ` Carlos O'Donell
[not found] ` <9043cc5a-e624-10c9-1906-f29010c5f57c-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
2017-09-14 5:30 ` Richard Guy Briggs
[not found] ` <20170914053007.GR3405-bcJWsdo4jJjeVoXN4CMphl7TgLCtbB0G@public.gmane.org>
2017-09-15 10:19 ` Richard Guy Briggs
2017-09-14 17:33 ` Eric W. Biederman [this message]
[not found] ` <87d16tb2y5.fsf-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>
2017-09-14 18:07 ` Richard Guy Briggs
2017-09-19 2:45 ` Eric W. Biederman
[not found] ` <87wp4v76f4.fsf-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>
2017-09-19 4:15 ` Richard Guy Briggs
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87d16tb2y5.fsf@xmission.com \
--to=ebiederm@xmission.com \
--cc=arozansk@redhat.com \
--cc=cgroups@vger.kernel.org \
--cc=containers@lists.linux-foundation.org \
--cc=dhowells@redhat.com \
--cc=eparis@parisplace.org \
--cc=jlayton@redhat.com \
--cc=linux-api@vger.kernel.org \
--cc=linux-audit@redhat.com \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=luto@kernel.org \
--cc=mszeredi@redhat.com \
--cc=netdev@vger.kernel.org \
--cc=pmoore@redhat.com \
--cc=rgb@redhat.com \
--cc=serge@hallyn.com \
--cc=sgrubb@redhat.com \
--cc=trondmy@primarydata.com \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).