From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-3.8 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_HELO_NONE, SPF_PASS,URIBL_BLOCKED autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id F0C09C10F14 for ; Fri, 11 Oct 2019 00:40:53 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id CC75F2190F for ; Fri, 11 Oct 2019 00:40:53 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=paul-moore-com.20150623.gappssmtp.com header.i=@paul-moore-com.20150623.gappssmtp.com header.b="excfJ/xP" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728059AbfJKAku (ORCPT ); Thu, 10 Oct 2019 20:40:50 -0400 Received: from mail-lj1-f193.google.com ([209.85.208.193]:35276 "EHLO mail-lj1-f193.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727864AbfJKAkt (ORCPT ); Thu, 10 Oct 2019 20:40:49 -0400 Received: by mail-lj1-f193.google.com with SMTP id m7so8075828lji.2 for ; Thu, 10 Oct 2019 17:40:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=paul-moore-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=H2FS1xOZd/52wDxpWUrAmpLbVkhqrk6X7y4KWQdphOQ=; b=excfJ/xPWZ2+jilbteJY4Vi+c9HHFbmh8FkB0VkVQqsRNzfaN29He3nWLonU+RXfhK 3pXMA0TLVwHppNQr0AUdUG53U42HF+9GxxpGlj/4kcIRtN2pAGAhjypJkZNwf6iE4U2K QnDU6KwbkTBSAhWjCsQuxo6Yvo3mAnUXyeDgSEkA6Cy+jFD7qJ0JXa3ufc+Z8Ubil/UN 0Cdjgen9Fv8pItZNyHwfvmTyOXAjZeb7m1pS8EB6mZ+mIjfO5jq4nE77VYMmJNXOtxB7 kvPLp8grvYwauQ5k1eqQDdg2eooaCdMYqVLWUpqPOHk/o0cD7moYJjQphs+tsLLeny72 W+eg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=H2FS1xOZd/52wDxpWUrAmpLbVkhqrk6X7y4KWQdphOQ=; b=tcLr4csVuzwZYHQj4GypswENODamr7GPitLC1DQxnke71uHN/wZ9Qtj4Gv6AonGN6k ljb59JB60F4g1MKKAYzJAY3FD8Hai3+1Q8hq5m0ZYhAtU8iZsQ3vwqxxeKTKVxKEYsuF GmBTY0Y5zwfQo7WYxrKiZFem/e+naxDxFvxZth8BtAVWI62ivtwaUw0vKlSFA0rrRGEU W0kqnTb5f4CMQA0ScjY0/+TOSgcp0QdGCtD5AX1QInaGsNtth1y7jX1mn3849enN9vxP PVOeKs7unn/qEn5WDZQcImck+mu9BbiRB70YMKhv60cQ/Em2ZauksY1BfDtd/yHStmLL 0Ldw== X-Gm-Message-State: APjAAAWWWGYXHVPBN/dnJfedRPdTUaPsGURK5wDp/UUzH+xGtZYwRKFx oiQBVUxx+t70DkQxhEqUIfOuJiNx5hpdZZSdECPx X-Google-Smtp-Source: APXvYqxJgQInWarY5/M7kUO7HpwvMg1Nlpj/lgKKRdJtv+USUKJpyXPsrOQoku+hafT+CZ2zq5wB40bIA3VRiBrUbu8= X-Received: by 2002:a2e:8ec2:: with SMTP id e2mr7129095ljl.126.1570754447449; Thu, 10 Oct 2019 17:40:47 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Paul Moore Date: Thu, 10 Oct 2019 20:40:36 -0400 Message-ID: Subject: Re: [PATCH ghak90 V7 16/21] audit: add support for contid set/get by netlink To: Richard Guy Briggs Cc: containers@lists.linux-foundation.org, linux-api@vger.kernel.org, Linux-Audit Mailing List , linux-fsdevel@vger.kernel.org, LKML , netdev@vger.kernel.org, netfilter-devel@vger.kernel.org, sgrubb@redhat.com, omosnace@redhat.com, dhowells@redhat.com, simo@redhat.com, Eric Paris , Serge Hallyn , ebiederm@xmission.com, nhorman@tuxdriver.com, Dan Walsh , mpatel@redhat.com Content-Type: text/plain; charset="UTF-8" Sender: netfilter-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org On Wed, Sep 18, 2019 at 9:26 PM Richard Guy Briggs wrote: > Add the ability to get and set the audit container identifier using an > audit netlink message using message types AUDIT_SET_CONTID 1023 and > AUDIT_GET_CONTID 1022 in addition to using the proc filesystem. The > message format includes the data structure: > > struct audit_contid_status { > pid_t pid; > u64 id; > }; > > Signed-off-by: Richard Guy Briggs > --- > include/uapi/linux/audit.h | 2 ++ > kernel/audit.c | 40 ++++++++++++++++++++++++++++++++++++++++ > kernel/audit.h | 5 +++++ > 3 files changed, 47 insertions(+) I'm not a fan of having multiple interfaces to do one thing if it can be avoided. Presumably the argument for the netlink API is the container folks don't want to have to mount /proc inside containers which are going to host nested orchestrators? Can you reasonably run a fully fledged orchestrator without a valid /proc? -- paul moore www.paul-moore.com