From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Message-ID: <1508263063.3129.35.camel@HansenPartnership.com>
Subject: Re: RFC(v2): Audit Kernel Container IDs
From: James Bottomley <James.Bottomley@HansenPartnership.com>
To: Steve Grubb <sgrubb@redhat.com>,
        Casey Schaufler <casey@schaufler-ca.com>
Cc: mszeredi@redhat.com, David Howells <dhowells@redhat.com>,
        Andy Lutomirski <luto@kernel.org>, jlayton@redhat.com,
        Carlos O'Donell <carlos@redhat.com>,
        Linux API <linux-api@vger.kernel.org>,
        Linux Containers <containers@lists.linux-foundation.org>,
        Linux Kernel <linux-kernel@vger.kernel.org>,
        Eric Paris <eparis@parisplace.org>, linux-audit@redhat.com,
        "Eric W. Biederman" <ebiederm@xmission.com>,
        Simo Sorce <simo@redhat.com>, cgroups@vger.kernel.org,
        Linux FS Devel <linux-fsdevel@vger.kernel.org>,
        trondmy@primarydata.com,
        Linux Network Development <netdev@vger.kernel.org>,
        Al Viro <viro@zeniv.linux.org.uk>
Date: Tue, 17 Oct 2017 10:57:43 -0700
In-Reply-To: <1982291.vr6V9CPzqu@x2>
References: <20171012141359.saqdtnodwmbz33b2@madcap2.tricolour.ca>
         <1508255091.3129.27.camel@HansenPartnership.com>
         <eb96144d-4ab5-7f9f-de18-b296db35a00a@schaufler-ca.com>
         <1982291.vr6V9CPzqu@x2>
Content-Type: text/plain; charset="UTF-8"
Mime-Version: 1.0
Content-Transfer-Encoding: 8bit
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-fsdevel.vger.kernel.org>

On Tue, 2017-10-17 at 13:15 -0400, Steve Grubb wrote:
> On Tuesday, October 17, 2017 12:43:18 PM EDT Casey Schaufler wrote:
> > 
> > > 
> > > The idea is that processes spawned into a container would be
> > > labelled by the container orchestration system.  It's unclear
> > > what should happen to processes using nsenter after the fact, but
> > > policy for that should be up to the orchestration system.
> > 
> > I'm fine with that. The user space policy can be anything y'all
> > like.
> 
> I think there should be a login event.

I thought you wanted this for containers?  Container creation doesn't
have login events.  In an unprivileged orchestration system it may be
hard to synthetically manufacture them.

James