From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]:54952 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S935104AbeCEN1w (ORCPT ); Mon, 5 Mar 2018 08:27:52 -0500 Received: from pps.filterd (m0098419.ppops.net [127.0.0.1]) by mx0b-001b2d01.pphosted.com (8.16.0.22/8.16.0.22) with SMTP id w25DOel5087809 for ; Mon, 5 Mar 2018 08:27:52 -0500 Received: from e06smtp11.uk.ibm.com (e06smtp11.uk.ibm.com [195.75.94.107]) by mx0b-001b2d01.pphosted.com with ESMTP id 2gh5gmknxf-1 (version=TLSv1.2 cipher=AES256-SHA256 bits=256 verify=NOT) for ; Mon, 05 Mar 2018 08:27:51 -0500 Received: from localhost by e06smtp11.uk.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Mon, 5 Mar 2018 13:27:49 -0000 Subject: Re: [RFC PATCH V1 00/12] audit: implement container id From: Mimi Zohar To: Richard Guy Briggs Cc: cgroups@vger.kernel.org, containers@lists.linux-foundation.org, linux-api@vger.kernel.org, Linux-Audit Mailing List , linux-fsdevel@vger.kernel.org, LKML , netdev@vger.kernel.org, mszeredi@redhat.com, ebiederm@xmission.com, simo@redhat.com, jlayton@redhat.com, carlos@redhat.com, dhowells@redhat.com, viro@zeniv.linux.org.uk, luto@kernel.org, eparis@parisplace.org, trondmy@primarydata.com, serge@hallyn.com Date: Mon, 05 Mar 2018 08:27:39 -0500 In-Reply-To: <20180305033128.6sqreoo5olqwq5og@madcap2.tricolour.ca> References: <1520200557.10396.257.camel@linux.vnet.ibm.com> <20180305033128.6sqreoo5olqwq5og@madcap2.tricolour.ca> Content-Type: text/plain; charset="UTF-8" Mime-Version: 1.0 Content-Transfer-Encoding: 8bit Message-Id: <1520256459.10396.283.camel@linux.vnet.ibm.com> Sender: linux-fsdevel-owner@vger.kernel.org List-ID: On Sun, 2018-03-04 at 22:31 -0500, Richard Guy Briggs wrote: > On 2018-03-04 16:55, Mimi Zohar wrote: > > On Thu, 2018-03-01 at 14:41 -0500, Richard Guy Briggs wrote: > > > Implement audit kernel container ID. > > > > > > This patchset is a preliminary RFC based on the proposal document (V3) > > > posted: > > > https://www.redhat.com/archives/linux-audit/2018-January/msg00014.html > > > > > > The first patch implements the proc fs write to set the audit container > > > ID of a process, emitting an AUDIT_CONTAINER record. > > > > > > The second implements an auxiliary syscall record AUDIT_CONTAINER_INFO > > > if a container ID is present on a task. > > > > > > The third adds filtering to the exit, exclude and user lists. > > > > > > The 4th, implements reading the container ID from the proc filesystem > > > for debugging. This isn't planned for upstream inclusion. > > > > > > The 5th adds signal and ptrace support. > > > > > > The 6th attempts to create a local audit context to be able to bind a > > > standalone record with the container ID record. > > > > > > The 7th, 8th, 9th, 10th patches add container ID records to standalone > > > records. Some of these may end up being syscall auxiliary records and > > > won't need this specific support since they'll be supported via > > > syscalls. > > > > > > The 11th is a temporary workaround due to the AUDIT_CONTAINER records > > > not showing up as do AUDIT_LOGIN records. I suspect this is due to its > > > range (1000 vs 1300), but the intent is to solve it. > > > > > > The 12th adds debug information not intended for upstream for those > > > brave souls wanting to tinker with it in this early state. > > > > > > Feedback please! > > > > Which tree can this patch set be applied to? > > git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit.git next Thanks, that worked.  In case anyone else is trying to apply these patches to a 4.16.0-rc based kernel, commit 4e7e3adbba52 ("Expand various INIT_* macros and remove") moved .sessionid to init/init_task.c. Mimi