From: Richard Guy Briggs <rgb@redhat.com> To: Steve Grubb <sgrubb@redhat.com> Cc: Paul Moore <paul@paul-moore.com>, cgroups@vger.kernel.org, containers@lists.linux-foundation.org, linux-api@vger.kernel.org, linux-audit@redhat.com, linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, ebiederm@xmission.com, luto@kernel.org, carlos@redhat.com, dhowells@redhat.com, viro@zeniv.linux.org.uk, simo@redhat.com, Eric Paris <eparis@parisplace.org>, serge@hallyn.com Subject: Re: [RFC PATCH ghak90 (was ghak32) V3 02/10] audit: log container info of syscalls Date: Sun, 22 Jul 2018 17:03:44 -0400 [thread overview] Message-ID: <20180722210344.kram6l7vvxniv2se@madcap2.tricolour.ca> (raw) In-Reply-To: <20180722205510.eh2n7bcd52454dwj@madcap2.tricolour.ca> On 2018-07-22 16:55, Richard Guy Briggs wrote: > On 2018-07-22 09:32, Steve Grubb wrote: > > On Saturday, July 21, 2018 4:29:30 PM EDT Richard Guy Briggs wrote: > > > > > + * audit_log_contid - report container info > > > > > + * @tsk: task to be recorded > > > > > + * @context: task or local context for record > > > > > + * @op: contid string description > > > > > + */ > > > > > +int audit_log_contid(struct task_struct *tsk, > > > > > + struct audit_context *context, char *op) > > > > > +{ > > > > > + struct audit_buffer *ab; > > > > > + > > > > > + if (!audit_contid_set(tsk)) > > > > > + return 0; > > > > > + /* Generate AUDIT_CONTAINER record with container ID */ > > > > > + ab = audit_log_start(context, GFP_KERNEL, AUDIT_CONTAINER); > > > > > + if (!ab) > > > > > + return -ENOMEM; > > > > > + audit_log_format(ab, "op=%s contid=%llu", > > > > > + op, audit_get_contid(tsk)); > > > > > > > > Can you explain your reason for including an "op" field in this record > > > > type? I've been looking at the rest of the patches in this patchset > > > > and it seems to be used more as an indicator of the record's > > > > generating context rather than any sort of audit container ID > > > > operation. > > > > > > "action" might work, but that's netfilter and numeric... "kind"? > > > Nothing else really seems to fit from a field name, type or lack of > > > searchability perspective. > > > > > > Steve, do you have an opinion? > > > > We only have 1 sample event where we have op=task. What are the other > > possible values? > > For the AUDIT_CONTAINER record we have op= "task", "target" (from the > ptrace and signals patch), "tty". Sorry, pressed "send" too quickly. Also "aux0x%x" (also from the ptrace/signals patch), "net%u" (from the AUDIT_NETFILTER_PKT patch). > For the AUDIT_CONTAINER_ID record we have "op=set". > > > -Steve > > - RGB - RGB -- Richard Guy Briggs <rgb@redhat.com> Sr. S/W Engineer, Kernel Security, Base Operating Systems Remote, Ottawa, Red Hat Canada IRC: rgb, SunRaycer Voice: +1.647.777.2635, Internal: (81) 32635
WARNING: multiple messages have this Message-ID (diff)
From: Richard Guy Briggs <rgb@redhat.com> To: Steve Grubb <sgrubb@redhat.com> Cc: simo@redhat.com, carlos@redhat.com, linux-api@vger.kernel.org, containers@lists.linux-foundation.org, linux-kernel@vger.kernel.org, Eric Paris <eparis@parisplace.org>, dhowells@redhat.com, linux-audit@redhat.com, ebiederm@xmission.com, luto@kernel.org, netdev@vger.kernel.org, linux-fsdevel@vger.kernel.org, cgroups@vger.kernel.org, serge@hallyn.com, viro@zeniv.linux.org.uk Subject: Re: [RFC PATCH ghak90 (was ghak32) V3 02/10] audit: log container info of syscalls Date: Sun, 22 Jul 2018 17:03:44 -0400 [thread overview] Message-ID: <20180722210344.kram6l7vvxniv2se@madcap2.tricolour.ca> (raw) In-Reply-To: <20180722205510.eh2n7bcd52454dwj@madcap2.tricolour.ca> On 2018-07-22 16:55, Richard Guy Briggs wrote: > On 2018-07-22 09:32, Steve Grubb wrote: > > On Saturday, July 21, 2018 4:29:30 PM EDT Richard Guy Briggs wrote: > > > > > + * audit_log_contid - report container info > > > > > + * @tsk: task to be recorded > > > > > + * @context: task or local context for record > > > > > + * @op: contid string description > > > > > + */ > > > > > +int audit_log_contid(struct task_struct *tsk, > > > > > + struct audit_context *context, char *op) > > > > > +{ > > > > > + struct audit_buffer *ab; > > > > > + > > > > > + if (!audit_contid_set(tsk)) > > > > > + return 0; > > > > > + /* Generate AUDIT_CONTAINER record with container ID */ > > > > > + ab = audit_log_start(context, GFP_KERNEL, AUDIT_CONTAINER); > > > > > + if (!ab) > > > > > + return -ENOMEM; > > > > > + audit_log_format(ab, "op=%s contid=%llu", > > > > > + op, audit_get_contid(tsk)); > > > > > > > > Can you explain your reason for including an "op" field in this record > > > > type? I've been looking at the rest of the patches in this patchset > > > > and it seems to be used more as an indicator of the record's > > > > generating context rather than any sort of audit container ID > > > > operation. > > > > > > "action" might work, but that's netfilter and numeric... "kind"? > > > Nothing else really seems to fit from a field name, type or lack of > > > searchability perspective. > > > > > > Steve, do you have an opinion? > > > > We only have 1 sample event where we have op=task. What are the other > > possible values? > > For the AUDIT_CONTAINER record we have op= "task", "target" (from the > ptrace and signals patch), "tty". Sorry, pressed "send" too quickly. Also "aux0x%x" (also from the ptrace/signals patch), "net%u" (from the AUDIT_NETFILTER_PKT patch). > For the AUDIT_CONTAINER_ID record we have "op=set". > > > -Steve > > - RGB - RGB -- Richard Guy Briggs <rgb@redhat.com> Sr. S/W Engineer, Kernel Security, Base Operating Systems Remote, Ottawa, Red Hat Canada IRC: rgb, SunRaycer Voice: +1.647.777.2635, Internal: (81) 32635
next prev parent reply other threads:[~2018-07-22 21:06 UTC|newest] Thread overview: 72+ messages / expand[flat|nested] mbox.gz Atom feed top 2018-06-06 16:58 [RFC PATCH ghak90 (was ghak32) V3 00/10] audit: implement container identifier Richard Guy Briggs 2018-06-06 16:58 ` [RFC PATCH ghak90 (was ghak32) V3 01/10] audit: add container id Richard Guy Briggs 2018-06-06 16:58 ` Richard Guy Briggs 2018-06-06 17:56 ` Steve Grubb 2018-06-06 20:26 ` Richard Guy Briggs 2018-07-20 22:13 ` Paul Moore 2018-07-24 19:06 ` Richard Guy Briggs 2018-07-24 19:06 ` Richard Guy Briggs 2018-07-24 21:54 ` Paul Moore 2018-07-30 18:47 ` Richard Guy Briggs 2018-07-30 18:47 ` Richard Guy Briggs 2018-06-06 16:58 ` [RFC PATCH ghak90 (was ghak32) V3 02/10] audit: log container info of syscalls Richard Guy Briggs 2018-06-06 17:58 ` Steve Grubb 2018-07-20 22:13 ` Paul Moore 2018-07-21 20:29 ` Richard Guy Briggs 2018-07-21 20:29 ` Richard Guy Briggs 2018-07-22 13:32 ` Steve Grubb 2018-07-22 13:32 ` Steve Grubb 2018-07-22 20:55 ` Richard Guy Briggs 2018-07-22 20:55 ` Richard Guy Briggs 2018-07-22 21:03 ` Richard Guy Briggs [this message] 2018-07-22 21:03 ` Richard Guy Briggs 2018-07-23 13:19 ` Steve Grubb 2018-07-23 15:11 ` Richard Guy Briggs 2018-07-23 16:48 ` Steve Grubb 2018-07-23 18:31 ` Paul Moore 2018-07-26 0:51 ` Richard Guy Briggs 2018-07-31 20:07 ` Richard Guy Briggs 2018-07-23 13:16 ` Paul Moore 2018-06-06 16:58 ` [RFC PATCH ghak90 (was ghak32) V3 03/10] audit: add containerid support for ptrace and signals Richard Guy Briggs 2018-07-20 22:13 ` Paul Moore 2018-06-06 16:58 ` [RFC PATCH ghak90 (was ghak32) V3 04/10] audit: add support for non-syscall auxiliary records Richard Guy Briggs 2018-06-06 16:58 ` Richard Guy Briggs 2018-07-20 22:14 ` Paul Moore 2018-07-24 19:37 ` Richard Guy Briggs 2018-07-24 19:37 ` Richard Guy Briggs 2018-07-24 21:57 ` Paul Moore 2018-07-26 14:30 ` Richard Guy Briggs 2018-07-26 14:30 ` Richard Guy Briggs 2018-06-06 16:58 ` [RFC PATCH ghak90 (was ghak32) V3 05/10] audit: add containerid support for tty_audit Richard Guy Briggs 2018-07-20 22:14 ` Paul Moore 2018-07-20 22:14 ` Paul Moore 2018-07-24 14:07 ` Richard Guy Briggs 2018-07-24 20:36 ` Paul Moore 2018-06-06 16:58 ` [RFC PATCH ghak90 (was ghak32) V3 06/10] audit: add containerid filtering Richard Guy Briggs 2018-07-20 22:14 ` Paul Moore 2018-07-20 22:14 ` Paul Moore 2018-06-06 16:58 ` [RFC PATCH ghak90 (was ghak32) V3 07/10] audit: add support for containerid to network namespaces Richard Guy Briggs 2018-07-20 22:14 ` Paul Moore 2018-07-24 14:03 ` Richard Guy Briggs 2018-07-24 20:33 ` Paul Moore 2018-07-26 13:33 ` Richard Guy Briggs 2018-07-26 13:33 ` Richard Guy Briggs 2018-06-06 16:58 ` [RFC PATCH ghak90 (was ghak32) V3 08/10] audit: NETFILTER_PKT: record each container ID associated with a netNS Richard Guy Briggs 2018-07-20 22:15 ` Paul Moore 2018-07-20 22:15 ` Paul Moore 2018-07-24 19:48 ` Steve Grubb 2018-07-24 20:22 ` Paul Moore 2018-07-24 20:55 ` Richard Guy Briggs 2018-07-24 20:55 ` Richard Guy Briggs 2018-07-21 15:32 ` Laura Garcia 2018-07-21 15:32 ` Laura Garcia 2018-06-06 16:58 ` [RFC PATCH ghak90 (was ghak32) V3 09/10] debug audit: read container ID of a process Richard Guy Briggs 2018-07-20 22:15 ` Paul Moore 2018-07-20 22:15 ` Paul Moore 2018-07-21 19:21 ` Richard Guy Briggs 2018-07-21 19:21 ` Richard Guy Briggs 2018-06-06 16:58 ` [RFC PATCH ghak90 (was ghak32) V3 10/10] rfkill: fix spelling mistake contidion to condition Richard Guy Briggs 2018-07-18 20:56 ` Paul Moore 2018-06-07 13:10 ` [RFC PATCH ghak90 (was ghak32) V3 00/10] audit: implement container identifier Stefan Berger 2018-06-07 14:20 ` Richard Guy Briggs 2018-07-19 15:40 ` Paul Moore
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20180722210344.kram6l7vvxniv2se@madcap2.tricolour.ca \ --to=rgb@redhat.com \ --cc=carlos@redhat.com \ --cc=cgroups@vger.kernel.org \ --cc=containers@lists.linux-foundation.org \ --cc=dhowells@redhat.com \ --cc=ebiederm@xmission.com \ --cc=eparis@parisplace.org \ --cc=linux-api@vger.kernel.org \ --cc=linux-audit@redhat.com \ --cc=linux-fsdevel@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=luto@kernel.org \ --cc=netdev@vger.kernel.org \ --cc=paul@paul-moore.com \ --cc=serge@hallyn.com \ --cc=sgrubb@redhat.com \ --cc=simo@redhat.com \ --cc=viro@zeniv.linux.org.uk \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.