From: Paul Moore <paul@paul-moore.com>
To: Richard Guy Briggs <rgb@redhat.com>
Cc: Jens Axboe <axboe@kernel.dk>, Neil Horman <nhorman@tuxdriver.com>,
Linux API <linux-api@vger.kernel.org>,
Linux Containers List <containers@lists.linux-foundation.org>,
LKML <linux-kernel@vger.kernel.org>,
David Howells <dhowells@redhat.com>,
Linux-Audit Mailing List <linux-audit@redhat.com>,
Netfilter Devel List <netfilter-devel@vger.kernel.org>,
"Eric W. Biederman" <ebiederm@xmission.com>,
Simo Sorce <simo@redhat.com>,
Linux NetDev Upstream Mailing List <netdev@vger.kernel.org>,
Linux FSdevel <linux-fsdevel@vger.kernel.org>,
Eric Paris <eparis@parisplace.org>,
mpatel@redhat.com
Subject: Re: [PATCH ghak90 v10 01/11] audit: collect audit task parameters
Date: Mon, 21 Dec 2020 12:14:38 -0500 [thread overview]
Message-ID: <CAHC9VhSTuBJ3LXxMY=nD7qBzmKLDjXY0V3hsuN34_siq_xRrig@mail.gmail.com> (raw)
In-Reply-To: <982b9adffbd32264a853fe7f4f06f0d0a882c11d.1608225886.git.rgb@redhat.com>
On Mon, Dec 21, 2020 at 11:57 AM Richard Guy Briggs <rgb@redhat.com> wrote:
>
> The audit-related parameters in struct task_struct should ideally be
> collected together and accessed through a standard audit API and the audit
> structures made opaque to other kernel subsystems.
>
> Collect the existing loginuid, sessionid and audit_context together in a
> new opaque struct audit_task_info called "audit" in struct task_struct.
>
> Use kmem_cache to manage this pool of memory.
> Un-inline audit_free() to be able to always recover that memory.
>
> Please see the upstream github issues
> https://github.com/linux-audit/audit-kernel/issues/81
> https://github.com/linux-audit/audit-kernel/issues/90
>
> Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
> Acked-by: Neil Horman <nhorman@tuxdriver.com>
> Reviewed-by: Ondrej Mosnacek <omosnace@redhat.com>
Did Neil and Ondrej really ACK/Review the changes that you made here
in v10 or are you just carrying over the ACK/Review? I'm hopeful it
is the former, because I'm going to be a little upset if it is the
latter.
> ---
> fs/io-wq.c | 8 +--
> fs/io_uring.c | 16 ++---
> include/linux/audit.h | 49 +++++---------
> include/linux/sched.h | 7 +-
> init/init_task.c | 3 +-
> init/main.c | 2 +
> kernel/audit.c | 154 +++++++++++++++++++++++++++++++++++++++++-
> kernel/audit.h | 7 ++
> kernel/auditsc.c | 24 ++++---
> kernel/fork.c | 1 -
> 10 files changed, 205 insertions(+), 66 deletions(-)
--
paul moore
www.paul-moore.com
_______________________________________________
Containers mailing list
Containers@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/containers
next prev parent reply other threads:[~2020-12-21 17:14 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-12-21 16:55 [PATCH ghak90 v10 00/11] audit: implement container identifier Richard Guy Briggs
2020-12-21 16:55 ` [PATCH ghak90 v10 01/11] audit: collect audit task parameters Richard Guy Briggs
2020-12-21 17:14 ` Paul Moore [this message]
2020-12-21 17:57 ` Richard Guy Briggs
2020-12-21 16:55 ` [PATCH ghak90 v10 02/11] audit: add container id Richard Guy Briggs
2020-12-21 16:55 ` [PATCH ghak90 v10 03/11] audit: log container info of syscalls Richard Guy Briggs
2020-12-21 16:55 ` [PATCH ghak90 v10 04/11] audit: add contid support for signalling the audit daemon Richard Guy Briggs
2020-12-21 16:55 ` [PATCH ghak90 v10 05/11] audit: add support for non-syscall auxiliary records Richard Guy Briggs
2020-12-21 16:55 ` [PATCH ghak90 v10 06/11] audit: add containerid support for user records Richard Guy Briggs
2020-12-21 16:55 ` [PATCH ghak90 v10 07/11] audit: add containerid filtering Richard Guy Briggs
2020-12-21 16:55 ` [PATCH ghak90 v10 08/11] audit: add support for containerid to network namespaces Richard Guy Briggs
2020-12-21 16:55 ` [PATCH ghak90 v10 09/11] audit: contid check descendancy and nesting Richard Guy Briggs
2020-12-21 16:55 ` [PATCH ghak90 v10 10/11] audit: track container nesting Richard Guy Briggs
2020-12-21 16:55 ` [PATCH ghak90 v10 11/11] audit: add capcontid to set contid outside init_user_ns Richard Guy Briggs
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAHC9VhSTuBJ3LXxMY=nD7qBzmKLDjXY0V3hsuN34_siq_xRrig@mail.gmail.com' \
--to=paul@paul-moore.com \
--cc=axboe@kernel.dk \
--cc=containers@lists.linux-foundation.org \
--cc=dhowells@redhat.com \
--cc=ebiederm@xmission.com \
--cc=eparis@parisplace.org \
--cc=linux-api@vger.kernel.org \
--cc=linux-audit@redhat.com \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mpatel@redhat.com \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=nhorman@tuxdriver.com \
--cc=rgb@redhat.com \
--cc=simo@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).