From: Richard Guy Briggs <rgb@redhat.com>
To: containers@lists.linux-foundation.org, linux-api@vger.kernel.org,
Linux-Audit Mailing List <linux-audit@redhat.com>,
linux-fsdevel@vger.kernel.org,
LKML <linux-kernel@vger.kernel.org>,
netdev@vger.kernel.org, netfilter-devel@vger.kernel.org
Cc: Paul Moore <paul@paul-moore.com>,
sgrubb@redhat.com, omosnace@redhat.com, dhowells@redhat.com,
simo@redhat.com, eparis@parisplace.org, serge@hallyn.com,
ebiederm@xmission.com, nhorman@tuxdriver.com, dwalsh@redhat.com,
mpatel@redhat.com, Richard Guy Briggs <rgb@redhat.com>
Subject: [PATCH ghak90 V8 09/16] audit: add containerid support for user records
Date: Tue, 31 Dec 2019 14:48:22 -0500 [thread overview]
Message-ID: <b15ffa6907fe03debdace27408f889dac731bea5.1577736799.git.rgb@redhat.com> (raw)
In-Reply-To: <cover.1577736799.git.rgb@redhat.com>
In-Reply-To: <cover.1577736799.git.rgb@redhat.com>
Add audit container identifier auxiliary record to user event standalone
records.
Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
Reviewed-by: Ondrej Mosnacek <omosnace@redhat.com>
---
kernel/audit.c | 13 ++++++-------
1 file changed, 6 insertions(+), 7 deletions(-)
diff --git a/kernel/audit.c b/kernel/audit.c
index 51159c94041c..d4e6eafe5644 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -1176,12 +1176,6 @@ static void audit_log_common_recv_msg(struct audit_context *context,
audit_log_task_context(*ab);
}
-static inline void audit_log_user_recv_msg(struct audit_buffer **ab,
- u16 msg_type)
-{
- audit_log_common_recv_msg(NULL, ab, msg_type);
-}
-
int is_audit_feature_set(int i)
{
return af.features & AUDIT_FEATURE_TO_MASK(i);
@@ -1444,13 +1438,16 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
err = audit_filter(msg_type, AUDIT_FILTER_USER);
if (err == 1) { /* match or error */
+ struct audit_context *context;
+
err = 0;
if (msg_type == AUDIT_USER_TTY) {
err = tty_audit_push();
if (err)
break;
}
- audit_log_user_recv_msg(&ab, msg_type);
+ context = audit_alloc_local(GFP_KERNEL);
+ audit_log_common_recv_msg(context, &ab, msg_type);
if (msg_type != AUDIT_USER_TTY)
audit_log_format(ab, " msg='%.*s'",
AUDIT_MESSAGE_TEXT_MAX,
@@ -1466,6 +1463,8 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
audit_log_n_untrustedstring(ab, data, size);
}
audit_log_end(ab);
+ audit_log_container_id(context, audit_get_contid(current));
+ audit_free_context(context);
}
break;
case AUDIT_ADD_RULE:
--
1.8.3.1
WARNING: multiple messages have this Message-ID (diff)
From: Richard Guy Briggs <rgb@redhat.com>
To: containers@lists.linux-foundation.org, linux-api@vger.kernel.org,
Linux-Audit Mailing List <linux-audit@redhat.com>,
linux-fsdevel@vger.kernel.org,
LKML <linux-kernel@vger.kernel.org>,
netdev@vger.kernel.org, netfilter-devel@vger.kernel.org
Cc: nhorman@tuxdriver.com, Richard Guy Briggs <rgb@redhat.com>,
dhowells@redhat.com, ebiederm@xmission.com, simo@redhat.com,
eparis@parisplace.org, mpatel@redhat.com, serge@hallyn.com
Subject: [PATCH ghak90 V8 09/16] audit: add containerid support for user records
Date: Tue, 31 Dec 2019 14:48:22 -0500 [thread overview]
Message-ID: <b15ffa6907fe03debdace27408f889dac731bea5.1577736799.git.rgb@redhat.com> (raw)
In-Reply-To: <cover.1577736799.git.rgb@redhat.com>
In-Reply-To: <cover.1577736799.git.rgb@redhat.com>
Add audit container identifier auxiliary record to user event standalone
records.
Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
Reviewed-by: Ondrej Mosnacek <omosnace@redhat.com>
---
kernel/audit.c | 13 ++++++-------
1 file changed, 6 insertions(+), 7 deletions(-)
diff --git a/kernel/audit.c b/kernel/audit.c
index 51159c94041c..d4e6eafe5644 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -1176,12 +1176,6 @@ static void audit_log_common_recv_msg(struct audit_context *context,
audit_log_task_context(*ab);
}
-static inline void audit_log_user_recv_msg(struct audit_buffer **ab,
- u16 msg_type)
-{
- audit_log_common_recv_msg(NULL, ab, msg_type);
-}
-
int is_audit_feature_set(int i)
{
return af.features & AUDIT_FEATURE_TO_MASK(i);
@@ -1444,13 +1438,16 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
err = audit_filter(msg_type, AUDIT_FILTER_USER);
if (err == 1) { /* match or error */
+ struct audit_context *context;
+
err = 0;
if (msg_type == AUDIT_USER_TTY) {
err = tty_audit_push();
if (err)
break;
}
- audit_log_user_recv_msg(&ab, msg_type);
+ context = audit_alloc_local(GFP_KERNEL);
+ audit_log_common_recv_msg(context, &ab, msg_type);
if (msg_type != AUDIT_USER_TTY)
audit_log_format(ab, " msg='%.*s'",
AUDIT_MESSAGE_TEXT_MAX,
@@ -1466,6 +1463,8 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
audit_log_n_untrustedstring(ab, data, size);
}
audit_log_end(ab);
+ audit_log_container_id(context, audit_get_contid(current));
+ audit_free_context(context);
}
break;
case AUDIT_ADD_RULE:
--
1.8.3.1
next prev parent reply other threads:[~2019-12-31 19:51 UTC|newest]
Thread overview: 168+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-12-31 19:48 [PATCH ghak90 V8 00/16] audit: implement container identifier Richard Guy Briggs
2019-12-31 19:48 ` [PATCH ghak90 V8 01/16] audit: collect audit task parameters Richard Guy Briggs
2019-12-31 19:48 ` [PATCH ghak90 V8 02/16] audit: add container id Richard Guy Briggs
2020-01-22 21:28 ` Paul Moore
2020-01-22 21:28 ` Paul Moore
2020-01-30 17:53 ` Richard Guy Briggs
2019-12-31 19:48 ` [PATCH ghak90 V8 03/16] audit: read container ID of a process Richard Guy Briggs
2019-12-31 19:48 ` [PATCH ghak90 V8 04/16] audit: convert to contid list to check for orch/engine ownership Richard Guy Briggs
2020-01-22 21:28 ` Paul Moore
2020-01-22 21:28 ` Paul Moore
2020-02-04 22:51 ` Richard Guy Briggs
2020-02-04 22:51 ` Richard Guy Briggs
2020-02-05 22:40 ` Paul Moore
2020-02-05 22:40 ` Paul Moore
2019-12-31 19:48 ` [PATCH ghak90 V8 05/16] audit: log drop of contid on exit of last task Richard Guy Briggs
2020-01-22 21:28 ` Paul Moore
2020-02-04 23:02 ` Richard Guy Briggs
2020-02-04 23:02 ` Richard Guy Briggs
2019-12-31 19:48 ` [PATCH ghak90 V8 06/16] audit: log container info of syscalls Richard Guy Briggs
2019-12-31 19:48 ` [PATCH ghak90 V8 07/16] audit: add contid support for signalling the audit daemon Richard Guy Briggs
2020-01-22 21:28 ` Paul Moore
2020-01-22 21:28 ` Paul Moore
2020-01-23 16:29 ` Richard Guy Briggs
2020-01-23 17:09 ` Paul Moore
2020-01-23 20:04 ` Richard Guy Briggs
2020-01-23 21:35 ` Paul Moore
2020-02-04 23:14 ` Richard Guy Briggs
2020-02-05 22:50 ` Paul Moore
2020-02-05 22:50 ` Paul Moore
2020-02-12 22:38 ` Steve Grubb
2020-02-13 0:09 ` Paul Moore
2020-02-13 21:44 ` Paul Moore
2020-03-12 19:30 ` Richard Guy Briggs
2020-03-12 19:30 ` Richard Guy Briggs
2020-03-13 16:29 ` Paul Moore
2020-03-13 16:29 ` Paul Moore
2020-03-13 18:59 ` Richard Guy Briggs
2020-03-13 18:59 ` Richard Guy Briggs
2020-03-18 20:56 ` Paul Moore
2020-03-18 20:56 ` Paul Moore
2020-03-18 21:26 ` Richard Guy Briggs
2020-03-18 21:26 ` Richard Guy Briggs
2020-03-18 21:42 ` Paul Moore
2020-03-18 21:42 ` Paul Moore
2020-03-18 21:55 ` Richard Guy Briggs
2020-03-18 21:55 ` Richard Guy Briggs
2020-03-18 22:06 ` Paul Moore
2020-03-18 22:06 ` Paul Moore
2020-03-19 22:02 ` Richard Guy Briggs
2020-03-19 22:02 ` Richard Guy Briggs
2020-03-24 0:16 ` Paul Moore
2020-03-24 0:16 ` Paul Moore
2020-03-24 21:01 ` Richard Guy Briggs
2020-03-24 21:01 ` Richard Guy Briggs
2020-03-29 3:11 ` Paul Moore
2020-03-29 3:11 ` Paul Moore
2020-03-30 13:47 ` Richard Guy Briggs
2020-03-30 13:47 ` Richard Guy Briggs
2020-03-30 14:26 ` Paul Moore
2020-03-30 14:26 ` Paul Moore
2020-03-30 16:21 ` Richard Guy Briggs
2020-03-30 16:21 ` Richard Guy Briggs
2020-03-30 17:34 ` Paul Moore
2020-03-30 17:34 ` Paul Moore
2020-03-30 17:49 ` Richard Guy Briggs
2020-03-30 17:49 ` Richard Guy Briggs
2020-03-30 19:55 ` Paul Moore
2020-03-30 19:55 ` Paul Moore
2020-04-16 20:33 ` Eric W. Biederman
2020-04-16 20:33 ` Eric W. Biederman
2020-04-16 21:53 ` Paul Moore
2020-04-16 21:53 ` Paul Moore
2020-04-17 22:23 ` Eric W. Biederman
2020-04-17 22:23 ` Eric W. Biederman
2020-04-22 17:24 ` Paul Moore
2020-04-22 17:24 ` Paul Moore
2020-06-08 18:03 ` Richard Guy Briggs
2020-06-08 18:03 ` Richard Guy Briggs
2020-06-17 21:33 ` Paul Moore
2020-06-17 21:33 ` Paul Moore
2020-06-19 15:22 ` Richard Guy Briggs
2020-06-19 15:22 ` Richard Guy Briggs
2020-03-12 20:27 ` Richard Guy Briggs
2020-03-12 20:27 ` Richard Guy Briggs
2020-03-13 16:42 ` Paul Moore
2020-03-13 16:42 ` Paul Moore
2020-03-13 16:45 ` Steve Grubb
2020-03-13 16:45 ` Steve Grubb
2020-03-13 16:49 ` Paul Moore
2020-03-13 16:49 ` Paul Moore
2020-03-13 19:23 ` Richard Guy Briggs
2020-03-13 19:23 ` Richard Guy Briggs
2020-03-18 21:01 ` Paul Moore
2020-03-18 21:01 ` Paul Moore
2020-03-18 21:41 ` Richard Guy Briggs
2020-03-18 21:41 ` Richard Guy Briggs
2020-03-18 21:47 ` Paul Moore
2020-03-18 21:47 ` Paul Moore
2020-03-19 21:47 ` Richard Guy Briggs
2020-03-19 21:47 ` Richard Guy Briggs
2020-03-20 21:56 ` Paul Moore
2020-03-20 21:56 ` Paul Moore
2020-03-25 12:29 ` Richard Guy Briggs
2020-03-25 12:29 ` Richard Guy Briggs
2020-03-29 3:17 ` Paul Moore
2020-03-29 3:17 ` Paul Moore
2020-03-30 15:23 ` Richard Guy Briggs
2020-03-30 15:23 ` Richard Guy Briggs
2019-12-31 19:48 ` [PATCH ghak90 V8 08/16] audit: add support for non-syscall auxiliary records Richard Guy Briggs
2019-12-31 19:48 ` Richard Guy Briggs [this message]
2019-12-31 19:48 ` [PATCH ghak90 V8 09/16] audit: add containerid support for user records Richard Guy Briggs
2019-12-31 19:48 ` [PATCH ghak90 V8 10/16] audit: add containerid filtering Richard Guy Briggs
2019-12-31 19:48 ` Richard Guy Briggs
2019-12-31 19:48 ` [PATCH ghak90 V8 11/16] audit: add support for containerid to network namespaces Richard Guy Briggs
2019-12-31 19:48 ` Richard Guy Briggs
2020-01-22 21:28 ` Paul Moore
2020-01-22 21:28 ` Paul Moore
2020-02-04 23:42 ` Richard Guy Briggs
2020-02-05 22:51 ` Paul Moore
2019-12-31 19:48 ` [PATCH ghak90 V8 12/16] audit: contid check descendancy and nesting Richard Guy Briggs
2019-12-31 19:48 ` Richard Guy Briggs
2020-01-22 21:29 ` Paul Moore
2020-01-22 21:29 ` Paul Moore
2020-01-23 21:02 ` Richard Guy Briggs
2020-01-23 21:47 ` Paul Moore
2019-12-31 19:48 ` [PATCH ghak90 V8 13/16] audit: track container nesting Richard Guy Briggs
2019-12-31 19:48 ` Richard Guy Briggs
2020-01-22 21:29 ` Paul Moore
2020-01-22 21:29 ` Paul Moore
2020-01-30 19:27 ` Richard Guy Briggs
2020-02-05 23:05 ` Paul Moore
2020-02-05 23:50 ` Richard Guy Briggs
2020-02-13 21:49 ` Paul Moore
2020-03-12 20:51 ` Richard Guy Briggs
2020-03-12 20:51 ` Richard Guy Briggs
2020-03-13 16:47 ` Paul Moore
2020-03-13 16:47 ` Paul Moore
2020-03-14 22:42 ` Richard Guy Briggs
2020-03-14 22:42 ` Richard Guy Briggs
2020-03-17 18:28 ` Richard Guy Briggs
2020-03-17 18:28 ` Richard Guy Briggs
2020-03-18 21:08 ` Paul Moore
2020-03-18 21:08 ` Paul Moore
2020-01-31 14:50 ` Steve Grubb
2020-02-04 13:19 ` Richard Guy Briggs
2020-02-04 15:47 ` Steve Grubb
2020-02-04 15:47 ` Steve Grubb
2020-02-04 15:52 ` Paul Moore
2020-02-04 15:52 ` Paul Moore
2020-02-04 18:12 ` Steve Grubb
2020-02-05 22:57 ` Paul Moore
2020-02-05 22:57 ` Paul Moore
2019-12-31 19:48 ` [PATCH ghak90 V8 14/16] audit: check contid depth and add limit config param Richard Guy Briggs
2020-01-22 21:29 ` Paul Moore
2020-01-22 21:29 ` Paul Moore
2019-12-31 19:48 ` [PATCH ghak90 V8 15/16] audit: check contid count per netns and add config param limit Richard Guy Briggs
2020-01-22 21:29 ` Paul Moore
2020-01-22 21:29 ` Paul Moore
2019-12-31 19:48 ` [PATCH ghak90 V8 16/16] audit: add capcontid to set contid outside init_user_ns Richard Guy Briggs
2020-01-22 21:29 ` Paul Moore
2020-01-22 21:29 ` Paul Moore
2020-02-05 0:39 ` Richard Guy Briggs
2020-02-05 22:56 ` Paul Moore
2020-02-06 12:51 ` Richard Guy Briggs
2020-02-13 21:58 ` Paul Moore
2020-02-13 21:58 ` Paul Moore
2020-03-12 21:58 ` Richard Guy Briggs
2020-03-12 21:58 ` Richard Guy Briggs
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=b15ffa6907fe03debdace27408f889dac731bea5.1577736799.git.rgb@redhat.com \
--to=rgb@redhat.com \
--cc=containers@lists.linux-foundation.org \
--cc=dhowells@redhat.com \
--cc=dwalsh@redhat.com \
--cc=ebiederm@xmission.com \
--cc=eparis@parisplace.org \
--cc=linux-api@vger.kernel.org \
--cc=linux-audit@redhat.com \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mpatel@redhat.com \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=nhorman@tuxdriver.com \
--cc=omosnace@redhat.com \
--cc=paul@paul-moore.com \
--cc=serge@hallyn.com \
--cc=sgrubb@redhat.com \
--cc=simo@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.