From: Richard Guy Briggs <rgb@redhat.com> To: containers@lists.linux-foundation.org, linux-api@vger.kernel.org, Linux-Audit Mailing List <linux-audit@redhat.com>, linux-fsdevel@vger.kernel.org, LKML <linux-kernel@vger.kernel.org>, netdev@vger.kernel.org, netfilter-devel@vger.kernel.org Cc: Paul Moore <paul@paul-moore.com>, sgrubb@redhat.com, omosnace@redhat.com, dhowells@redhat.com, simo@redhat.com, eparis@parisplace.org, serge@hallyn.com, ebiederm@xmission.com, nhorman@tuxdriver.com, Richard Guy Briggs <rgb@redhat.com> Subject: [PATCH ghak90 V6 09/10] audit: add support for containerid to network namespaces Date: Mon, 8 Apr 2019 23:39:16 -0400 [thread overview] Message-ID: <423ed5e5c5e4ed7c3e26ac7d2bd7c267aaae777c.1554732921.git.rgb@redhat.com> (raw) In-Reply-To: <cover.1554732921.git.rgb@redhat.com> In-Reply-To: <cover.1554732921.git.rgb@redhat.com> Audit events could happen in a network namespace outside of a task context due to packets received from the net that trigger an auditing rule prior to being associated with a running task. The network namespace could be in use by multiple containers by association to the tasks in that network namespace. We still want a way to attribute these events to any potential containers. Keep a list per network namespace to track these audit container identifiiers. Add/increment the audit container identifier on: - initial setting of the audit container identifier via /proc - clone/fork call that inherits an audit container identifier - unshare call that inherits an audit container identifier - setns call that inherits an audit container identifier Delete/decrement the audit container identifier on: - an inherited audit container identifier dropped when child set - process exit - unshare call that drops a net namespace - setns call that drops a net namespace Please see the github audit kernel issue for contid net support: https://github.com/linux-audit/audit-kernel/issues/92 Please see the github audit testsuiite issue for the test case: https://github.com/linux-audit/audit-testsuite/issues/64 Please see the github audit wiki for the feature overview: https://github.com/linux-audit/audit-kernel/wiki/RFE-Audit-Container-ID Signed-off-by: Richard Guy Briggs <rgb@redhat.com> Acked-by: Neil Horman <nhorman@tuxdriver.com> Reviewed-by: Ondrej Mosnacek <omosnace@redhat.com> --- include/linux/audit.h | 19 +++++++++++ kernel/audit.c | 88 +++++++++++++++++++++++++++++++++++++++++++++++++-- kernel/nsproxy.c | 4 +++ 3 files changed, 108 insertions(+), 3 deletions(-) diff --git a/include/linux/audit.h b/include/linux/audit.h index 6e42e6a10736..4b2503927c37 100644 --- a/include/linux/audit.h +++ b/include/linux/audit.h @@ -27,6 +27,7 @@ #include <linux/ptrace.h> #include <linux/namei.h> /* LOOKUP_* */ #include <uapi/linux/audit.h> +#include <linux/refcount.h> #define AUDIT_INO_UNSET ((unsigned long)-1) #define AUDIT_DEV_UNSET ((dev_t)-1) @@ -105,6 +106,13 @@ struct audit_task_info { extern struct audit_task_info init_struct_audit; +struct audit_contid { + struct list_head list; + u64 id; + refcount_t refcount; + struct rcu_head rcu; +}; + extern int is_audit_feature_set(int which); extern int __init audit_register_class(int class, unsigned *list); @@ -208,6 +216,10 @@ static inline u64 audit_get_contid(struct task_struct *tsk) } extern void audit_log_contid(struct audit_context *context, u64 contid); +extern void audit_netns_contid_add(struct net *net, u64 contid); +extern void audit_netns_contid_del(struct net *net, u64 contid); +extern void audit_switch_task_namespaces(struct nsproxy *ns, + struct task_struct *p); extern u32 audit_enabled; #else /* CONFIG_AUDIT */ @@ -277,6 +289,13 @@ static inline u64 audit_get_contid(struct task_struct *tsk) static inline void audit_log_contid(struct audit_context *context, u64 contid) { } +static inline void audit_netns_contid_add(struct net *net, u64 contid) +{ } +static inline void audit_netns_contid_del(struct net *net, u64 contid) +{ } +static inline void audit_switch_task_namespaces(struct nsproxy *ns, + struct task_struct *p) +{ } #define audit_enabled AUDIT_OFF #endif /* CONFIG_AUDIT */ diff --git a/kernel/audit.c b/kernel/audit.c index 6c742da66b32..996213591617 100644 --- a/kernel/audit.c +++ b/kernel/audit.c @@ -72,6 +72,7 @@ #include <linux/freezer.h> #include <linux/pid_namespace.h> #include <net/netns/generic.h> +#include <net/net_namespace.h> #include "audit.h" @@ -99,9 +100,13 @@ /** * struct audit_net - audit private network namespace data * @sk: communication socket + * @contid_list: audit container identifier list + * @contid_list_lock audit container identifier list lock */ struct audit_net { struct sock *sk; + struct list_head contid_list; + spinlock_t contid_list_lock; }; /** @@ -275,8 +280,11 @@ struct audit_task_info init_struct_audit = { void audit_free(struct task_struct *tsk) { struct audit_task_info *info = tsk->audit; + struct nsproxy *ns = tsk->nsproxy; audit_free_syscall(tsk); + if (ns) + audit_netns_contid_del(ns->net_ns, audit_get_contid(tsk)); /* Freeing the audit_task_info struct must be performed after * audit_log_exit() due to need for loginuid and sessionid. */ @@ -376,6 +384,75 @@ static struct sock *audit_get_sk(const struct net *net) return aunet->sk; } +void audit_netns_contid_add(struct net *net, u64 contid) +{ + struct audit_net *aunet; + struct list_head *contid_list; + struct audit_contid *cont; + + if (!net) + return; + if (!audit_contid_valid(contid)) + return; + aunet = net_generic(net, audit_net_id); + if (!aunet) + return; + contid_list = &aunet->contid_list; + spin_lock(&aunet->contid_list_lock); + list_for_each_entry_rcu(cont, contid_list, list) + if (cont->id == contid) { + refcount_inc(&cont->refcount); + goto out; + } + cont = kmalloc(sizeof(struct audit_contid), GFP_ATOMIC); + if (cont) { + INIT_LIST_HEAD(&cont->list); + cont->id = contid; + refcount_set(&cont->refcount, 1); + list_add_rcu(&cont->list, contid_list); + } +out: + spin_unlock(&aunet->contid_list_lock); +} + +void audit_netns_contid_del(struct net *net, u64 contid) +{ + struct audit_net *aunet; + struct list_head *contid_list; + struct audit_contid *cont = NULL; + + if (!net) + return; + if (!audit_contid_valid(contid)) + return; + aunet = net_generic(net, audit_net_id); + if (!aunet) + return; + contid_list = &aunet->contid_list; + spin_lock(&aunet->contid_list_lock); + list_for_each_entry_rcu(cont, contid_list, list) + if (cont->id == contid) { + if (refcount_dec_and_test(&cont->refcount)) { + list_del_rcu(&cont->list); + kfree_rcu(cont, rcu); + } + break; + } + spin_unlock(&aunet->contid_list_lock); +} + +void audit_switch_task_namespaces(struct nsproxy *ns, struct task_struct *p) +{ + u64 contid = audit_get_contid(p); + struct nsproxy *new = p->nsproxy; + + if (!audit_contid_valid(contid)) + return; + audit_netns_contid_del(ns->net_ns, contid); + if (new) + audit_netns_contid_add(new->net_ns, contid); +} + void audit_panic(const char *message) { switch (audit_failure) { @@ -1644,7 +1721,6 @@ static int __net_init audit_net_init(struct net *net) .flags = NL_CFG_F_NONROOT_RECV, .groups = AUDIT_NLGRP_MAX, }; - struct audit_net *aunet = net_generic(net, audit_net_id); aunet->sk = netlink_kernel_create(net, NETLINK_AUDIT, &cfg); @@ -1653,7 +1729,8 @@ static int __net_init audit_net_init(struct net *net) return -ENOMEM; } aunet->sk->sk_sndtimeo = MAX_SCHEDULE_TIMEOUT; - + INIT_LIST_HEAD(&aunet->contid_list); + spin_lock_init(&aunet->contid_list_lock); return 0; } @@ -2404,6 +2481,7 @@ int audit_set_contid(struct task_struct *task, u64 contid) uid_t uid; struct tty_struct *tty; char comm[sizeof(current->comm)]; + struct net *net = task->nsproxy->net_ns; task_lock(task); /* Can't set if audit disabled */ @@ -2425,8 +2503,12 @@ int audit_set_contid(struct task_struct *task, u64 contid) else if (!(thread_group_leader(task) && thread_group_empty(task))) rc = -EALREADY; read_unlock(&tasklist_lock); - if (!rc) + if (!rc) { + if (audit_contid_valid(oldcontid)) + audit_netns_contid_del(net, oldcontid); task->audit->contid = contid; + audit_netns_contid_add(net, contid); + } task_unlock(task); if (!audit_enabled) diff --git a/kernel/nsproxy.c b/kernel/nsproxy.c index f6c5d330059a..718b1201ae70 100644 --- a/kernel/nsproxy.c +++ b/kernel/nsproxy.c @@ -27,6 +27,7 @@ #include <linux/syscalls.h> #include <linux/cgroup.h> #include <linux/perf_event.h> +#include <linux/audit.h> static struct kmem_cache *nsproxy_cachep; @@ -140,6 +141,7 @@ int copy_namespaces(unsigned long flags, struct task_struct *tsk) struct nsproxy *old_ns = tsk->nsproxy; struct user_namespace *user_ns = task_cred_xxx(tsk, user_ns); struct nsproxy *new_ns; + u64 contid = audit_get_contid(tsk); if (likely(!(flags & (CLONE_NEWNS | CLONE_NEWUTS | CLONE_NEWIPC | CLONE_NEWPID | CLONE_NEWNET | @@ -167,6 +169,7 @@ int copy_namespaces(unsigned long flags, struct task_struct *tsk) return PTR_ERR(new_ns); tsk->nsproxy = new_ns; + audit_netns_contid_add(new_ns->net_ns, contid); return 0; } @@ -224,6 +227,7 @@ void switch_task_namespaces(struct task_struct *p, struct nsproxy *new) ns = p->nsproxy; p->nsproxy = new; task_unlock(p); + audit_switch_task_namespaces(ns, p); if (ns && atomic_dec_and_test(&ns->count)) free_nsproxy(ns); -- 1.8.3.1
WARNING: multiple messages have this Message-ID (diff)
From: Richard Guy Briggs <rgb@redhat.com> To: containers@lists.linux-foundation.org, linux-api@vger.kernel.org, Linux-Audit Mailing List <linux-audit@redhat.com>, linux-fsdevel@vger.kernel.org, LKML <linux-kernel@vger.kernel.org>, netdev@vger.kernel.org, netfilter-devel@vger.kernel.org Cc: nhorman@tuxdriver.com, Richard Guy Briggs <rgb@redhat.com>, dhowells@redhat.com, ebiederm@xmission.com, simo@redhat.com, eparis@parisplace.org, serge@hallyn.com Subject: [PATCH ghak90 V6 09/10] audit: add support for containerid to network namespaces Date: Mon, 8 Apr 2019 23:39:16 -0400 [thread overview] Message-ID: <423ed5e5c5e4ed7c3e26ac7d2bd7c267aaae777c.1554732921.git.rgb@redhat.com> (raw) In-Reply-To: <cover.1554732921.git.rgb@redhat.com> In-Reply-To: <cover.1554732921.git.rgb@redhat.com> Audit events could happen in a network namespace outside of a task context due to packets received from the net that trigger an auditing rule prior to being associated with a running task. The network namespace could be in use by multiple containers by association to the tasks in that network namespace. We still want a way to attribute these events to any potential containers. Keep a list per network namespace to track these audit container identifiiers. Add/increment the audit container identifier on: - initial setting of the audit container identifier via /proc - clone/fork call that inherits an audit container identifier - unshare call that inherits an audit container identifier - setns call that inherits an audit container identifier Delete/decrement the audit container identifier on: - an inherited audit container identifier dropped when child set - process exit - unshare call that drops a net namespace - setns call that drops a net namespace Please see the github audit kernel issue for contid net support: https://github.com/linux-audit/audit-kernel/issues/92 Please see the github audit testsuiite issue for the test case: https://github.com/linux-audit/audit-testsuite/issues/64 Please see the github audit wiki for the feature overview: https://github.com/linux-audit/audit-kernel/wiki/RFE-Audit-Container-ID Signed-off-by: Richard Guy Briggs <rgb@redhat.com> Acked-by: Neil Horman <nhorman@tuxdriver.com> Reviewed-by: Ondrej Mosnacek <omosnace@redhat.com> --- include/linux/audit.h | 19 +++++++++++ kernel/audit.c | 88 +++++++++++++++++++++++++++++++++++++++++++++++++-- kernel/nsproxy.c | 4 +++ 3 files changed, 108 insertions(+), 3 deletions(-) diff --git a/include/linux/audit.h b/include/linux/audit.h index 6e42e6a10736..4b2503927c37 100644 --- a/include/linux/audit.h +++ b/include/linux/audit.h @@ -27,6 +27,7 @@ #include <linux/ptrace.h> #include <linux/namei.h> /* LOOKUP_* */ #include <uapi/linux/audit.h> +#include <linux/refcount.h> #define AUDIT_INO_UNSET ((unsigned long)-1) #define AUDIT_DEV_UNSET ((dev_t)-1) @@ -105,6 +106,13 @@ struct audit_task_info { extern struct audit_task_info init_struct_audit; +struct audit_contid { + struct list_head list; + u64 id; + refcount_t refcount; + struct rcu_head rcu; +}; + extern int is_audit_feature_set(int which); extern int __init audit_register_class(int class, unsigned *list); @@ -208,6 +216,10 @@ static inline u64 audit_get_contid(struct task_struct *tsk) } extern void audit_log_contid(struct audit_context *context, u64 contid); +extern void audit_netns_contid_add(struct net *net, u64 contid); +extern void audit_netns_contid_del(struct net *net, u64 contid); +extern void audit_switch_task_namespaces(struct nsproxy *ns, + struct task_struct *p); extern u32 audit_enabled; #else /* CONFIG_AUDIT */ @@ -277,6 +289,13 @@ static inline u64 audit_get_contid(struct task_struct *tsk) static inline void audit_log_contid(struct audit_context *context, u64 contid) { } +static inline void audit_netns_contid_add(struct net *net, u64 contid) +{ } +static inline void audit_netns_contid_del(struct net *net, u64 contid) +{ } +static inline void audit_switch_task_namespaces(struct nsproxy *ns, + struct task_struct *p) +{ } #define audit_enabled AUDIT_OFF #endif /* CONFIG_AUDIT */ diff --git a/kernel/audit.c b/kernel/audit.c index 6c742da66b32..996213591617 100644 --- a/kernel/audit.c +++ b/kernel/audit.c @@ -72,6 +72,7 @@ #include <linux/freezer.h> #include <linux/pid_namespace.h> #include <net/netns/generic.h> +#include <net/net_namespace.h> #include "audit.h" @@ -99,9 +100,13 @@ /** * struct audit_net - audit private network namespace data * @sk: communication socket + * @contid_list: audit container identifier list + * @contid_list_lock audit container identifier list lock */ struct audit_net { struct sock *sk; + struct list_head contid_list; + spinlock_t contid_list_lock; }; /** @@ -275,8 +280,11 @@ struct audit_task_info init_struct_audit = { void audit_free(struct task_struct *tsk) { struct audit_task_info *info = tsk->audit; + struct nsproxy *ns = tsk->nsproxy; audit_free_syscall(tsk); + if (ns) + audit_netns_contid_del(ns->net_ns, audit_get_contid(tsk)); /* Freeing the audit_task_info struct must be performed after * audit_log_exit() due to need for loginuid and sessionid. */ @@ -376,6 +384,75 @@ static struct sock *audit_get_sk(const struct net *net) return aunet->sk; } +void audit_netns_contid_add(struct net *net, u64 contid) +{ + struct audit_net *aunet; + struct list_head *contid_list; + struct audit_contid *cont; + + if (!net) + return; + if (!audit_contid_valid(contid)) + return; + aunet = net_generic(net, audit_net_id); + if (!aunet) + return; + contid_list = &aunet->contid_list; + spin_lock(&aunet->contid_list_lock); + list_for_each_entry_rcu(cont, contid_list, list) + if (cont->id == contid) { + refcount_inc(&cont->refcount); + goto out; + } + cont = kmalloc(sizeof(struct audit_contid), GFP_ATOMIC); + if (cont) { + INIT_LIST_HEAD(&cont->list); + cont->id = contid; + refcount_set(&cont->refcount, 1); + list_add_rcu(&cont->list, contid_list); + } +out: + spin_unlock(&aunet->contid_list_lock); +} + +void audit_netns_contid_del(struct net *net, u64 contid) +{ + struct audit_net *aunet; + struct list_head *contid_list; + struct audit_contid *cont = NULL; + + if (!net) + return; + if (!audit_contid_valid(contid)) + return; + aunet = net_generic(net, audit_net_id); + if (!aunet) + return; + contid_list = &aunet->contid_list; + spin_lock(&aunet->contid_list_lock); + list_for_each_entry_rcu(cont, contid_list, list) + if (cont->id == contid) { + if (refcount_dec_and_test(&cont->refcount)) { + list_del_rcu(&cont->list); + kfree_rcu(cont, rcu); + } + break; + } + spin_unlock(&aunet->contid_list_lock); +} + +void audit_switch_task_namespaces(struct nsproxy *ns, struct task_struct *p) +{ + u64 contid = audit_get_contid(p); + struct nsproxy *new = p->nsproxy; + + if (!audit_contid_valid(contid)) + return; + audit_netns_contid_del(ns->net_ns, contid); + if (new) + audit_netns_contid_add(new->net_ns, contid); +} + void audit_panic(const char *message) { switch (audit_failure) { @@ -1644,7 +1721,6 @@ static int __net_init audit_net_init(struct net *net) .flags = NL_CFG_F_NONROOT_RECV, .groups = AUDIT_NLGRP_MAX, }; - struct audit_net *aunet = net_generic(net, audit_net_id); aunet->sk = netlink_kernel_create(net, NETLINK_AUDIT, &cfg); @@ -1653,7 +1729,8 @@ static int __net_init audit_net_init(struct net *net) return -ENOMEM; } aunet->sk->sk_sndtimeo = MAX_SCHEDULE_TIMEOUT; - + INIT_LIST_HEAD(&aunet->contid_list); + spin_lock_init(&aunet->contid_list_lock); return 0; } @@ -2404,6 +2481,7 @@ int audit_set_contid(struct task_struct *task, u64 contid) uid_t uid; struct tty_struct *tty; char comm[sizeof(current->comm)]; + struct net *net = task->nsproxy->net_ns; task_lock(task); /* Can't set if audit disabled */ @@ -2425,8 +2503,12 @@ int audit_set_contid(struct task_struct *task, u64 contid) else if (!(thread_group_leader(task) && thread_group_empty(task))) rc = -EALREADY; read_unlock(&tasklist_lock); - if (!rc) + if (!rc) { + if (audit_contid_valid(oldcontid)) + audit_netns_contid_del(net, oldcontid); task->audit->contid = contid; + audit_netns_contid_add(net, contid); + } task_unlock(task); if (!audit_enabled) diff --git a/kernel/nsproxy.c b/kernel/nsproxy.c index f6c5d330059a..718b1201ae70 100644 --- a/kernel/nsproxy.c +++ b/kernel/nsproxy.c @@ -27,6 +27,7 @@ #include <linux/syscalls.h> #include <linux/cgroup.h> #include <linux/perf_event.h> +#include <linux/audit.h> static struct kmem_cache *nsproxy_cachep; @@ -140,6 +141,7 @@ int copy_namespaces(unsigned long flags, struct task_struct *tsk) struct nsproxy *old_ns = tsk->nsproxy; struct user_namespace *user_ns = task_cred_xxx(tsk, user_ns); struct nsproxy *new_ns; + u64 contid = audit_get_contid(tsk); if (likely(!(flags & (CLONE_NEWNS | CLONE_NEWUTS | CLONE_NEWIPC | CLONE_NEWPID | CLONE_NEWNET | @@ -167,6 +169,7 @@ int copy_namespaces(unsigned long flags, struct task_struct *tsk) return PTR_ERR(new_ns); tsk->nsproxy = new_ns; + audit_netns_contid_add(new_ns->net_ns, contid); return 0; } @@ -224,6 +227,7 @@ void switch_task_namespaces(struct task_struct *p, struct nsproxy *new) ns = p->nsproxy; p->nsproxy = new; task_unlock(p); + audit_switch_task_namespaces(ns, p); if (ns && atomic_dec_and_test(&ns->count)) free_nsproxy(ns); -- 1.8.3.1
next prev parent reply other threads:[~2019-04-09 3:41 UTC|newest] Thread overview: 102+ messages / expand[flat|nested] mbox.gz Atom feed top 2019-04-09 3:39 [PATCH ghak90 V6 00/10] audit: implement container identifier Richard Guy Briggs 2019-04-09 3:39 ` [PATCH ghak90 V6 01/10] audit: collect audit task parameters Richard Guy Briggs 2019-04-09 3:39 ` [PATCH ghak90 V6 02/10] audit: add container id Richard Guy Briggs 2019-05-29 14:57 ` Tycho Andersen 2019-05-29 15:29 ` Paul Moore 2019-05-29 15:29 ` Paul Moore 2019-05-29 15:34 ` Tycho Andersen 2019-05-29 16:03 ` Paul Moore 2019-05-29 22:28 ` Tycho Andersen 2019-05-29 22:39 ` Paul Moore 2019-05-30 17:09 ` Serge E. Hallyn 2019-05-30 19:29 ` Paul Moore 2019-05-30 21:29 ` Tycho Andersen 2019-05-30 21:29 ` Tycho Andersen 2019-05-30 23:26 ` Paul Moore 2019-05-31 0:20 ` Richard Guy Briggs 2019-05-31 12:44 ` Paul Moore 2019-06-03 20:24 ` Steve Grubb 2019-06-18 22:12 ` Paul Moore 2019-06-18 22:12 ` Paul Moore 2019-06-18 22:46 ` Richard Guy Briggs 2019-07-08 18:12 ` Richard Guy Briggs 2019-07-08 20:43 ` Paul Moore 2019-07-08 20:43 ` Paul Moore 2019-07-15 21:09 ` Paul Moore 2019-07-16 15:37 ` Richard Guy Briggs 2019-07-16 16:08 ` Paul Moore 2019-07-16 16:26 ` Richard Guy Briggs 2019-07-16 16:26 ` Richard Guy Briggs 2019-07-08 18:05 ` Richard Guy Briggs 2019-07-15 21:04 ` Paul Moore 2019-07-15 21:04 ` Paul Moore 2019-07-16 22:03 ` Richard Guy Briggs 2019-07-16 23:30 ` Paul Moore 2019-07-18 0:51 ` Richard Guy Briggs 2019-07-18 0:51 ` Richard Guy Briggs 2019-07-18 21:52 ` Paul Moore 2019-07-19 16:00 ` Eric W. Biederman 2019-07-19 22:41 ` Burn Alting 2019-07-20 2:19 ` James Bottomley 2019-07-19 15:32 ` Eric W. Biederman 2019-07-08 17:51 ` Richard Guy Briggs 2019-07-15 20:38 ` Paul Moore 2019-07-16 19:38 ` Richard Guy Briggs 2019-07-16 21:39 ` Paul Moore 2019-07-19 16:07 ` Eric W. Biederman 2019-04-09 3:39 ` [PATCH ghak90 V6 03/10] audit: read container ID of a process Richard Guy Briggs 2019-07-19 16:03 ` Eric W. Biederman 2019-07-19 17:05 ` Richard Guy Briggs 2019-07-19 17:05 ` Richard Guy Briggs 2019-04-09 3:39 ` [PATCH ghak90 V6 04/10] audit: log container info of syscalls Richard Guy Briggs 2019-05-29 22:15 ` Paul Moore 2019-05-29 22:15 ` Paul Moore 2019-05-30 13:08 ` Ondrej Mosnacek 2019-05-30 14:08 ` Richard Guy Briggs 2019-05-30 14:34 ` Paul Moore 2019-04-09 3:39 ` [PATCH ghak90 V6 05/10] audit: add contid support for signalling the audit daemon Richard Guy Briggs 2019-04-09 12:57 ` Ondrej Mosnacek 2019-04-09 13:40 ` Paul Moore 2019-04-09 13:48 ` Neil Horman 2019-04-09 14:00 ` Ondrej Mosnacek 2019-04-09 14:07 ` Paul Moore 2019-04-09 13:53 ` Richard Guy Briggs 2019-04-09 14:08 ` Paul Moore 2019-04-09 13:46 ` Neil Horman 2019-04-09 3:39 ` [PATCH ghak90 V6 06/10] audit: add support for non-syscall auxiliary records Richard Guy Briggs 2019-04-09 3:39 ` Richard Guy Briggs 2019-04-09 3:39 ` [PATCH ghak90 V6 07/10] audit: add containerid support for user records Richard Guy Briggs 2019-04-09 3:39 ` [PATCH ghak90 V6 08/10] audit: add containerid filtering Richard Guy Briggs 2019-05-29 22:16 ` Paul Moore 2019-05-30 14:19 ` Richard Guy Briggs 2019-05-30 14:34 ` Paul Moore 2019-05-30 20:37 ` Richard Guy Briggs 2019-05-30 20:45 ` Paul Moore 2019-05-30 20:45 ` Paul Moore 2019-05-30 21:10 ` Richard Guy Briggs 2019-05-30 21:10 ` Richard Guy Briggs 2019-04-09 3:39 ` Richard Guy Briggs [this message] 2019-04-09 3:39 ` [PATCH ghak90 V6 09/10] audit: add support for containerid to network namespaces Richard Guy Briggs 2019-05-29 22:17 ` Paul Moore 2019-05-29 22:17 ` Paul Moore 2019-05-30 14:15 ` Richard Guy Briggs 2019-05-30 14:32 ` Paul Moore 2019-04-09 3:39 ` [PATCH ghak90 V6 10/10] audit: NETFILTER_PKT: record each container ID associated with a netNS Richard Guy Briggs 2019-04-11 11:31 ` [PATCH ghak90 V6 00/10] audit: implement container identifier Richard Guy Briggs 2019-04-22 11:38 ` Neil Horman 2019-04-22 13:49 ` Paul Moore 2019-04-23 10:28 ` Neil Horman 2019-05-28 21:53 ` Daniel Walsh 2019-05-28 22:25 ` Richard Guy Briggs 2019-05-28 22:26 ` Paul Moore 2019-05-28 23:00 ` Steve Grubb 2019-05-29 0:43 ` Richard Guy Briggs 2019-05-29 12:02 ` Daniel Walsh 2019-05-29 13:17 ` Paul Moore 2019-05-29 14:07 ` Daniel Walsh 2019-05-29 14:33 ` Paul Moore 2019-05-29 13:14 ` Paul Moore 2019-05-29 22:26 ` Paul Moore 2019-05-30 13:08 ` Steve Grubb 2019-05-30 13:35 ` Paul Moore 2019-05-30 14:08 ` Richard Guy Briggs
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=423ed5e5c5e4ed7c3e26ac7d2bd7c267aaae777c.1554732921.git.rgb@redhat.com \ --to=rgb@redhat.com \ --cc=containers@lists.linux-foundation.org \ --cc=dhowells@redhat.com \ --cc=ebiederm@xmission.com \ --cc=eparis@parisplace.org \ --cc=linux-api@vger.kernel.org \ --cc=linux-audit@redhat.com \ --cc=linux-fsdevel@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=netdev@vger.kernel.org \ --cc=netfilter-devel@vger.kernel.org \ --cc=nhorman@tuxdriver.com \ --cc=omosnace@redhat.com \ --cc=paul@paul-moore.com \ --cc=serge@hallyn.com \ --cc=sgrubb@redhat.com \ --cc=simo@redhat.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.