From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-lj1-f194.google.com ([209.85.208.194]:42219 "EHLO mail-lj1-f194.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728095AbeJ1Qhu (ORCPT ); Sun, 28 Oct 2018 12:37:50 -0400 Received: by mail-lj1-f194.google.com with SMTP id f3-v6so4853781ljk.9 for ; Sun, 28 Oct 2018 00:53:56 -0700 (PDT) MIME-Version: 1.0 References: <34017c395d03a213d6b0d49b9964429bd32b283d.1533065887.git.rgb@redhat.com> <20181024151439.lavhanabsyxdrdvo@madcap2.tricolour.ca> <20181025004255.zl7p7j6gztouh2hh@madcap2.tricolour.ca> <20181025080638.771621a3@ivy-bridge> <20181025122732.4j4rbychjse3gemt@madcap2.tricolour.ca> <20181025175745.5b2b13e9@ivy-bridge> <20181025173830.4yklhnrydt5qvr67@madcap2.tricolour.ca> <20181025235527.15a39d75@ivy-bridge> In-Reply-To: From: Paul Moore Date: Sun, 28 Oct 2018 03:53:44 -0400 Message-ID: Subject: Re: [PATCH ghak90 (was ghak32) V4 03/10] audit: log container info of syscalls To: casey@schaufler-ca.com Cc: sgrubb@redhat.com, luto@kernel.org, rgb@redhat.com, linux-api@vger.kernel.org, containers@lists.linux-foundation.org, linux-kernel@vger.kernel.org, viro@zeniv.linux.org.uk, dhowells@redhat.com, carlos@redhat.com, linux-audit@redhat.com, netfilter-devel@vger.kernel.org, ebiederm@xmission.com, simo@redhat.com, netdev@vger.kernel.org, linux-fsdevel@vger.kernel.org, Eric Paris , Serge Hallyn Content-Type: text/plain; charset="UTF-8" Sender: linux-fsdevel-owner@vger.kernel.org List-ID: On Fri, Oct 26, 2018 at 4:13 AM Casey Schaufler wrote: > On 10/25/2018 2:55 PM, Steve Grubb wrote: > > ... > > And historically speaking setting audit loginuid produces a LOGIN > > event, so it only makes sense to consider binding container ID to > > container as a CONTAINER event. For other supplemental records, we name > > things what they are: PATH, CWD, SOCKADDR, etc. So, CONTAINER_ID makes > > sense. CONTAINER_OP sounds like its for operations on a container. Do > > we have any operations on a container? > > The answer has to be "no", because containers are, by emphatic assertion, > not kernel constructs. Any CONTAINER_OP event has to come from user space. > I think. It is very important that we do not confuse operations on the audit container id with operations on the containers themselves. Of course at a higher level, e.g. audit log analysis, we want to equate the two, and if the container runtime which manages the audit container id is sane that should be a reasonable assumption, but in this particular patchset AUDIT_CONTAINER_OP is referring to operations involving just the audit container id. If there is a need for additional container operation auditing (note well that I did not say audit container id here) then those audit records can, and should, be generated by the container runtime itself, similar to what we do with libvirt for virtualization. -- paul moore www.paul-moore.com