From: Richard Guy Briggs <rgb@redhat.com> To: Paul Moore <paul@paul-moore.com> Cc: Steve Grubb <sgrubb@redhat.com>, linux-audit@redhat.com, nhorman@tuxdriver.com, linux-api@vger.kernel.org, containers@lists.linux-foundation.org, LKML <linux-kernel@vger.kernel.org>, dhowells@redhat.com, netfilter-devel@vger.kernel.org, ebiederm@xmission.com, simo@redhat.com, netdev@vger.kernel.org, linux-fsdevel@vger.kernel.org, Eric Paris <eparis@parisplace.org>, mpatel@redhat.com, Serge Hallyn <serge@hallyn.com> Subject: Re: [PATCH ghak90 V8 07/16] audit: add contid support for signalling the audit daemon Date: Thu, 12 Mar 2020 15:30:37 -0400 [thread overview] Message-ID: <20200312193037.2tb5f53yeisfq4ta@madcap2.tricolour.ca> (raw) In-Reply-To: <CAHC9VhS09b_fM19tn7pHZzxfyxcHnK+PJx80Z9Z1hn8-==4oLA@mail.gmail.com> On 2020-02-13 16:44, Paul Moore wrote: > This is a bit of a thread-hijack, and for that I apologize, but > another thought crossed my mind while thinking about this issue > further ... Once we support multiple auditd instances, including the > necessary record routing and duplication/multiple-sends (the host > always sees *everything*), we will likely need to find a way to "trim" > the audit container ID (ACID) lists we send in the records. The > auditd instance running on the host/initns will always see everything, > so it will want the full container ACID list; however an auditd > instance running inside a container really should only see the ACIDs > of any child containers. Agreed. This should be easy to check and limit, preventing an auditd from seeing any contid that is a parent of its own contid. > For example, imagine a system where the host has containers 1 and 2, > each running an auditd instance. Inside container 1 there are > containers A and B. Inside container 2 there are containers Y and Z. > If an audit event is generated in container Z, I would expect the > host's auditd to see a ACID list of "1,Z" but container 1's auditd > should only see an ACID list of "Z". The auditd running in container > 2 should not see the record at all (that will be relatively > straightforward). Does that make sense? Do we have the record > formats properly designed to handle this without too much problem (I'm > not entirely sure we do)? I completely agree and I believe we have record formats that are able to handle this already. > paul moore - RGB -- Richard Guy Briggs <rgb@redhat.com> Sr. S/W Engineer, Kernel Security, Base Operating Systems Remote, Ottawa, Red Hat Canada IRC: rgb, SunRaycer Voice: +1.647.777.2635, Internal: (81) 32635
WARNING: multiple messages have this Message-ID (diff)
From: Richard Guy Briggs <rgb@redhat.com> To: Paul Moore <paul@paul-moore.com> Cc: nhorman@tuxdriver.com, linux-api@vger.kernel.org, containers@lists.linux-foundation.org, LKML <linux-kernel@vger.kernel.org>, dhowells@redhat.com, linux-audit@redhat.com, netfilter-devel@vger.kernel.org, ebiederm@xmission.com, simo@redhat.com, netdev@vger.kernel.org, linux-fsdevel@vger.kernel.org, Eric Paris <eparis@parisplace.org>, mpatel@redhat.com, Serge Hallyn <serge@hallyn.com> Subject: Re: [PATCH ghak90 V8 07/16] audit: add contid support for signalling the audit daemon Date: Thu, 12 Mar 2020 15:30:37 -0400 [thread overview] Message-ID: <20200312193037.2tb5f53yeisfq4ta@madcap2.tricolour.ca> (raw) In-Reply-To: <CAHC9VhS09b_fM19tn7pHZzxfyxcHnK+PJx80Z9Z1hn8-==4oLA@mail.gmail.com> On 2020-02-13 16:44, Paul Moore wrote: > This is a bit of a thread-hijack, and for that I apologize, but > another thought crossed my mind while thinking about this issue > further ... Once we support multiple auditd instances, including the > necessary record routing and duplication/multiple-sends (the host > always sees *everything*), we will likely need to find a way to "trim" > the audit container ID (ACID) lists we send in the records. The > auditd instance running on the host/initns will always see everything, > so it will want the full container ACID list; however an auditd > instance running inside a container really should only see the ACIDs > of any child containers. Agreed. This should be easy to check and limit, preventing an auditd from seeing any contid that is a parent of its own contid. > For example, imagine a system where the host has containers 1 and 2, > each running an auditd instance. Inside container 1 there are > containers A and B. Inside container 2 there are containers Y and Z. > If an audit event is generated in container Z, I would expect the > host's auditd to see a ACID list of "1,Z" but container 1's auditd > should only see an ACID list of "Z". The auditd running in container > 2 should not see the record at all (that will be relatively > straightforward). Does that make sense? Do we have the record > formats properly designed to handle this without too much problem (I'm > not entirely sure we do)? I completely agree and I believe we have record formats that are able to handle this already. > paul moore - RGB -- Richard Guy Briggs <rgb@redhat.com> Sr. S/W Engineer, Kernel Security, Base Operating Systems Remote, Ottawa, Red Hat Canada IRC: rgb, SunRaycer Voice: +1.647.777.2635, Internal: (81) 32635 -- Linux-audit mailing list Linux-audit@redhat.com https://www.redhat.com/mailman/listinfo/linux-audit
next prev parent reply other threads:[~2020-03-12 19:30 UTC|newest] Thread overview: 168+ messages / expand[flat|nested] mbox.gz Atom feed top 2019-12-31 19:48 [PATCH ghak90 V8 00/16] audit: implement container identifier Richard Guy Briggs 2019-12-31 19:48 ` [PATCH ghak90 V8 01/16] audit: collect audit task parameters Richard Guy Briggs 2019-12-31 19:48 ` [PATCH ghak90 V8 02/16] audit: add container id Richard Guy Briggs 2020-01-22 21:28 ` Paul Moore 2020-01-22 21:28 ` Paul Moore 2020-01-30 17:53 ` Richard Guy Briggs 2019-12-31 19:48 ` [PATCH ghak90 V8 03/16] audit: read container ID of a process Richard Guy Briggs 2019-12-31 19:48 ` [PATCH ghak90 V8 04/16] audit: convert to contid list to check for orch/engine ownership Richard Guy Briggs 2020-01-22 21:28 ` Paul Moore 2020-01-22 21:28 ` Paul Moore 2020-02-04 22:51 ` Richard Guy Briggs 2020-02-04 22:51 ` Richard Guy Briggs 2020-02-05 22:40 ` Paul Moore 2020-02-05 22:40 ` Paul Moore 2019-12-31 19:48 ` [PATCH ghak90 V8 05/16] audit: log drop of contid on exit of last task Richard Guy Briggs 2020-01-22 21:28 ` Paul Moore 2020-02-04 23:02 ` Richard Guy Briggs 2020-02-04 23:02 ` Richard Guy Briggs 2019-12-31 19:48 ` [PATCH ghak90 V8 06/16] audit: log container info of syscalls Richard Guy Briggs 2019-12-31 19:48 ` [PATCH ghak90 V8 07/16] audit: add contid support for signalling the audit daemon Richard Guy Briggs 2020-01-22 21:28 ` Paul Moore 2020-01-22 21:28 ` Paul Moore 2020-01-23 16:29 ` Richard Guy Briggs 2020-01-23 17:09 ` Paul Moore 2020-01-23 20:04 ` Richard Guy Briggs 2020-01-23 21:35 ` Paul Moore 2020-02-04 23:14 ` Richard Guy Briggs 2020-02-05 22:50 ` Paul Moore 2020-02-05 22:50 ` Paul Moore 2020-02-12 22:38 ` Steve Grubb 2020-02-13 0:09 ` Paul Moore 2020-02-13 21:44 ` Paul Moore 2020-03-12 19:30 ` Richard Guy Briggs [this message] 2020-03-12 19:30 ` Richard Guy Briggs 2020-03-13 16:29 ` Paul Moore 2020-03-13 16:29 ` Paul Moore 2020-03-13 18:59 ` Richard Guy Briggs 2020-03-13 18:59 ` Richard Guy Briggs 2020-03-18 20:56 ` Paul Moore 2020-03-18 20:56 ` Paul Moore 2020-03-18 21:26 ` Richard Guy Briggs 2020-03-18 21:26 ` Richard Guy Briggs 2020-03-18 21:42 ` Paul Moore 2020-03-18 21:42 ` Paul Moore 2020-03-18 21:55 ` Richard Guy Briggs 2020-03-18 21:55 ` Richard Guy Briggs 2020-03-18 22:06 ` Paul Moore 2020-03-18 22:06 ` Paul Moore 2020-03-19 22:02 ` Richard Guy Briggs 2020-03-19 22:02 ` Richard Guy Briggs 2020-03-24 0:16 ` Paul Moore 2020-03-24 0:16 ` Paul Moore 2020-03-24 21:01 ` Richard Guy Briggs 2020-03-24 21:01 ` Richard Guy Briggs 2020-03-29 3:11 ` Paul Moore 2020-03-29 3:11 ` Paul Moore 2020-03-30 13:47 ` Richard Guy Briggs 2020-03-30 13:47 ` Richard Guy Briggs 2020-03-30 14:26 ` Paul Moore 2020-03-30 14:26 ` Paul Moore 2020-03-30 16:21 ` Richard Guy Briggs 2020-03-30 16:21 ` Richard Guy Briggs 2020-03-30 17:34 ` Paul Moore 2020-03-30 17:34 ` Paul Moore 2020-03-30 17:49 ` Richard Guy Briggs 2020-03-30 17:49 ` Richard Guy Briggs 2020-03-30 19:55 ` Paul Moore 2020-03-30 19:55 ` Paul Moore 2020-04-16 20:33 ` Eric W. Biederman 2020-04-16 20:33 ` Eric W. Biederman 2020-04-16 21:53 ` Paul Moore 2020-04-16 21:53 ` Paul Moore 2020-04-17 22:23 ` Eric W. Biederman 2020-04-17 22:23 ` Eric W. Biederman 2020-04-22 17:24 ` Paul Moore 2020-04-22 17:24 ` Paul Moore 2020-06-08 18:03 ` Richard Guy Briggs 2020-06-08 18:03 ` Richard Guy Briggs 2020-06-17 21:33 ` Paul Moore 2020-06-17 21:33 ` Paul Moore 2020-06-19 15:22 ` Richard Guy Briggs 2020-06-19 15:22 ` Richard Guy Briggs 2020-03-12 20:27 ` Richard Guy Briggs 2020-03-12 20:27 ` Richard Guy Briggs 2020-03-13 16:42 ` Paul Moore 2020-03-13 16:42 ` Paul Moore 2020-03-13 16:45 ` Steve Grubb 2020-03-13 16:45 ` Steve Grubb 2020-03-13 16:49 ` Paul Moore 2020-03-13 16:49 ` Paul Moore 2020-03-13 19:23 ` Richard Guy Briggs 2020-03-13 19:23 ` Richard Guy Briggs 2020-03-18 21:01 ` Paul Moore 2020-03-18 21:01 ` Paul Moore 2020-03-18 21:41 ` Richard Guy Briggs 2020-03-18 21:41 ` Richard Guy Briggs 2020-03-18 21:47 ` Paul Moore 2020-03-18 21:47 ` Paul Moore 2020-03-19 21:47 ` Richard Guy Briggs 2020-03-19 21:47 ` Richard Guy Briggs 2020-03-20 21:56 ` Paul Moore 2020-03-20 21:56 ` Paul Moore 2020-03-25 12:29 ` Richard Guy Briggs 2020-03-25 12:29 ` Richard Guy Briggs 2020-03-29 3:17 ` Paul Moore 2020-03-29 3:17 ` Paul Moore 2020-03-30 15:23 ` Richard Guy Briggs 2020-03-30 15:23 ` Richard Guy Briggs 2019-12-31 19:48 ` [PATCH ghak90 V8 08/16] audit: add support for non-syscall auxiliary records Richard Guy Briggs 2019-12-31 19:48 ` [PATCH ghak90 V8 09/16] audit: add containerid support for user records Richard Guy Briggs 2019-12-31 19:48 ` Richard Guy Briggs 2019-12-31 19:48 ` [PATCH ghak90 V8 10/16] audit: add containerid filtering Richard Guy Briggs 2019-12-31 19:48 ` Richard Guy Briggs 2019-12-31 19:48 ` [PATCH ghak90 V8 11/16] audit: add support for containerid to network namespaces Richard Guy Briggs 2019-12-31 19:48 ` Richard Guy Briggs 2020-01-22 21:28 ` Paul Moore 2020-01-22 21:28 ` Paul Moore 2020-02-04 23:42 ` Richard Guy Briggs 2020-02-05 22:51 ` Paul Moore 2019-12-31 19:48 ` [PATCH ghak90 V8 12/16] audit: contid check descendancy and nesting Richard Guy Briggs 2019-12-31 19:48 ` Richard Guy Briggs 2020-01-22 21:29 ` Paul Moore 2020-01-22 21:29 ` Paul Moore 2020-01-23 21:02 ` Richard Guy Briggs 2020-01-23 21:47 ` Paul Moore 2019-12-31 19:48 ` [PATCH ghak90 V8 13/16] audit: track container nesting Richard Guy Briggs 2019-12-31 19:48 ` Richard Guy Briggs 2020-01-22 21:29 ` Paul Moore 2020-01-22 21:29 ` Paul Moore 2020-01-30 19:27 ` Richard Guy Briggs 2020-02-05 23:05 ` Paul Moore 2020-02-05 23:50 ` Richard Guy Briggs 2020-02-13 21:49 ` Paul Moore 2020-03-12 20:51 ` Richard Guy Briggs 2020-03-12 20:51 ` Richard Guy Briggs 2020-03-13 16:47 ` Paul Moore 2020-03-13 16:47 ` Paul Moore 2020-03-14 22:42 ` Richard Guy Briggs 2020-03-14 22:42 ` Richard Guy Briggs 2020-03-17 18:28 ` Richard Guy Briggs 2020-03-17 18:28 ` Richard Guy Briggs 2020-03-18 21:08 ` Paul Moore 2020-03-18 21:08 ` Paul Moore 2020-01-31 14:50 ` Steve Grubb 2020-02-04 13:19 ` Richard Guy Briggs 2020-02-04 15:47 ` Steve Grubb 2020-02-04 15:47 ` Steve Grubb 2020-02-04 15:52 ` Paul Moore 2020-02-04 15:52 ` Paul Moore 2020-02-04 18:12 ` Steve Grubb 2020-02-05 22:57 ` Paul Moore 2020-02-05 22:57 ` Paul Moore 2019-12-31 19:48 ` [PATCH ghak90 V8 14/16] audit: check contid depth and add limit config param Richard Guy Briggs 2020-01-22 21:29 ` Paul Moore 2020-01-22 21:29 ` Paul Moore 2019-12-31 19:48 ` [PATCH ghak90 V8 15/16] audit: check contid count per netns and add config param limit Richard Guy Briggs 2020-01-22 21:29 ` Paul Moore 2020-01-22 21:29 ` Paul Moore 2019-12-31 19:48 ` [PATCH ghak90 V8 16/16] audit: add capcontid to set contid outside init_user_ns Richard Guy Briggs 2020-01-22 21:29 ` Paul Moore 2020-01-22 21:29 ` Paul Moore 2020-02-05 0:39 ` Richard Guy Briggs 2020-02-05 22:56 ` Paul Moore 2020-02-06 12:51 ` Richard Guy Briggs 2020-02-13 21:58 ` Paul Moore 2020-02-13 21:58 ` Paul Moore 2020-03-12 21:58 ` Richard Guy Briggs 2020-03-12 21:58 ` Richard Guy Briggs
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20200312193037.2tb5f53yeisfq4ta@madcap2.tricolour.ca \ --to=rgb@redhat.com \ --cc=containers@lists.linux-foundation.org \ --cc=dhowells@redhat.com \ --cc=ebiederm@xmission.com \ --cc=eparis@parisplace.org \ --cc=linux-api@vger.kernel.org \ --cc=linux-audit@redhat.com \ --cc=linux-fsdevel@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=mpatel@redhat.com \ --cc=netdev@vger.kernel.org \ --cc=netfilter-devel@vger.kernel.org \ --cc=nhorman@tuxdriver.com \ --cc=paul@paul-moore.com \ --cc=serge@hallyn.com \ --cc=sgrubb@redhat.com \ --cc=simo@redhat.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.