From: Steve Grubb <sgrubb@redhat.com>
To: linux-audit@redhat.com
Cc: Paul Moore <paul@paul-moore.com>,
Richard Guy Briggs <rgb@redhat.com>,
nhorman@tuxdriver.com, linux-api@vger.kernel.org,
containers@lists.linux-foundation.org,
LKML <linux-kernel@vger.kernel.org>,
dhowells@redhat.com, netfilter-devel@vger.kernel.org,
ebiederm@xmission.com, simo@redhat.com, netdev@vger.kernel.org,
linux-fsdevel@vger.kernel.org, Eric Paris <eparis@parisplace.org>,
mpatel@redhat.com, Serge Hallyn <serge@hallyn.com>
Subject: Re: [PATCH ghak90 V8 07/16] audit: add contid support for signalling the audit daemon
Date: Wed, 12 Feb 2020 17:38:45 -0500 [thread overview]
Message-ID: <3142237.YMNxv0uec1@x2> (raw)
In-Reply-To: <CAHC9VhQquokw+7UOU=G0SsD35UdgmfysVKCGCE87JVaoTkbisg@mail.gmail.com>
On Wednesday, February 5, 2020 5:50:28 PM EST Paul Moore wrote:
> > > > > ... When we record the audit container ID in audit_signal_info() we
> > > > > take an extra reference to the audit container ID object so that it
> > > > > will not disappear (and get reused) until after we respond with an
> > > > > AUDIT_SIGNAL_INFO2. In audit_receive_msg() when we do the
> > > > > AUDIT_SIGNAL_INFO2 processing we drop the extra reference we took
> > > > > in
> > > > > audit_signal_info(). Unless I'm missing some other change you
> > > > > made,
> > > > > this *shouldn't* affect the syscall records, all it does is
> > > > > preserve
> > > > > the audit container ID object in the kernel's ACID store so it
> > > > > doesn't
> > > > > get reused.
> > > >
> > > > This is exactly what I had understood. I hadn't considered the extra
> > > > details below in detail due to my original syscall concern, but they
> > > > make sense.
> > > >
> > > > The syscall I refer to is the one connected with the drop of the
> > > > audit container identifier by the last process that was in that
> > > > container in patch 5/16. The production of this record is contingent
> > > > on
> > > > the last ref in a contobj being dropped. So if it is due to that ref
> > > > being maintained by audit_signal_info() until the AUDIT_SIGNAL_INFO2
> > > > record it fetched, then it will appear that the fetch action closed
> > > > the
> > > > container rather than the last process in the container to exit.
> > > >
> > > > Does this make sense?
> > >
> > > More so than your original reply, at least to me anyway.
> > >
> > > It makes sense that the audit container ID wouldn't be marked as
> > > "dead" since it would still be very much alive and available for use
> > > by the orchestrator, the question is if that is desirable or not. I
> > > think the answer to this comes down the preserving the correctness of
> > > the audit log.
> > >
> > > If the audit container ID reported by AUDIT_SIGNAL_INFO2 has been
> > > reused then I think there is a legitimate concern that the audit log
> > > is not correct, and could be misleading. If we solve that by grabbing
> > > an extra reference, then there could also be some confusion as
> > > userspace considers a container to be "dead" while the audit container
> > > ID still exists in the kernel, and the kernel generated audit
> > > container ID death record will not be generated until much later (and
> > > possibly be associated with a different event, but that could be
> > > solved by unassociating the container death record).
> >
> > How does syscall association of the death record with AUDIT_SIGNAL_INFO2
> > possibly get associated with another event? Or is the syscall
> > association with the fetch for the AUDIT_SIGNAL_INFO2 the other event?
>
> The issue is when does the audit container ID "die". If it is when
> the last task in the container exits, then the death record will be
> associated when the task's exit. If the audit container ID lives on
> until the last reference of it in the audit logs, including the
> SIGNAL_INFO2 message, the death record will be associated with the
> related SIGNAL_INFO2 syscalls, or perhaps unassociated depending on
> the details of the syscalls/netlink.
>
> > Another idea might be to bump the refcount in audit_signal_info() but
> > mark tht contid as dead so it can't be reused if we are concerned that
> > the dead contid be reused?
>
> Ooof. Yes, maybe, but that would be ugly.
>
> > There is still the problem later that the reported contid is incomplete
> > compared to the rest of the contid reporting cycle wrt nesting since
> > AUDIT_SIGNAL_INFO2 will need to be more complex w/2 variable length
> > fields to accommodate a nested contid list.
>
> Do we really care about the full nested audit container ID list in the
> SIGNAL_INFO2 record?
>
> > > Of the two
> > > approaches, I think the latter is safer in that it preserves the
> > > correctness of the audit log, even though it could result in a delay
> > > of the container death record.
> >
> > I prefer the former since it strongly indicates last task in the
> > container. The AUDIT_SIGNAL_INFO2 msg has the pid and other subject
> > attributes and the contid to strongly link the responsible party.
>
> Steve is the only one who really tracks the security certifications
> that are relevant to audit, see what the certification requirements
> have to say and we can revisit this.
Sever Virtualization Protection Profile is the closest applicable standard
https://www.niap-ccevs.org/Profile/Info.cfm?PPID=408&id=408
It is silent on audit requirements for the lifecycle of a VM. I assume that
all that is needed is what the orchestrator says its doing at the high level.
So, if an orchestrator wants to shutdown a container, the orchestrator must
log that intent and its results. In a similar fashion, systemd logs that it's
killing a service and we don't actually hook the exit syscall of the service
to record that.
Now, if a container was being used as a VPS, and it had a fully functioning
userspace, it's own services, and its very own audit daemon, then in this
case it would care who sent a signal to its auditd. The tenant of that
container may have to comply with PCI-DSS or something else. It would log the
audit service is being terminated and systemd would record that its tearing
down the environment. The OS doesn't need to do anything.
-Steve
next prev parent reply other threads:[~2020-02-12 22:39 UTC|newest]
Thread overview: 102+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-12-31 19:48 [PATCH ghak90 V8 00/16] audit: implement container identifier Richard Guy Briggs
2019-12-31 19:48 ` [PATCH ghak90 V8 01/16] audit: collect audit task parameters Richard Guy Briggs
2019-12-31 19:48 ` [PATCH ghak90 V8 02/16] audit: add container id Richard Guy Briggs
2020-01-22 21:28 ` Paul Moore
2020-01-30 17:53 ` Richard Guy Briggs
2019-12-31 19:48 ` [PATCH ghak90 V8 03/16] audit: read container ID of a process Richard Guy Briggs
2019-12-31 19:48 ` [PATCH ghak90 V8 04/16] audit: convert to contid list to check for orch/engine ownership Richard Guy Briggs
2020-01-22 21:28 ` Paul Moore
2020-02-04 22:51 ` Richard Guy Briggs
2020-02-05 22:40 ` Paul Moore
2019-12-31 19:48 ` [PATCH ghak90 V8 05/16] audit: log drop of contid on exit of last task Richard Guy Briggs
2020-01-22 21:28 ` Paul Moore
2020-02-04 23:02 ` Richard Guy Briggs
2019-12-31 19:48 ` [PATCH ghak90 V8 06/16] audit: log container info of syscalls Richard Guy Briggs
2019-12-31 19:48 ` [PATCH ghak90 V8 07/16] audit: add contid support for signalling the audit daemon Richard Guy Briggs
2020-01-22 21:28 ` Paul Moore
2020-01-23 16:29 ` Richard Guy Briggs
2020-01-23 17:09 ` Paul Moore
2020-01-23 20:04 ` Richard Guy Briggs
2020-01-23 21:35 ` Paul Moore
2020-02-04 23:14 ` Richard Guy Briggs
2020-02-05 22:50 ` Paul Moore
2020-02-12 22:38 ` Steve Grubb [this message]
2020-02-13 0:09 ` Paul Moore
2020-02-13 21:44 ` Paul Moore
2020-03-12 19:30 ` Richard Guy Briggs
2020-03-13 16:29 ` Paul Moore
2020-03-13 18:59 ` Richard Guy Briggs
2020-03-18 20:56 ` Paul Moore
2020-03-18 21:26 ` Richard Guy Briggs
2020-03-18 21:42 ` Paul Moore
2020-03-18 21:55 ` Richard Guy Briggs
2020-03-18 22:06 ` Paul Moore
2020-03-19 22:02 ` Richard Guy Briggs
2020-03-24 0:16 ` Paul Moore
2020-03-24 21:01 ` Richard Guy Briggs
2020-03-29 3:11 ` Paul Moore
2020-03-30 13:47 ` Richard Guy Briggs
2020-03-30 14:26 ` Paul Moore
2020-03-30 16:21 ` Richard Guy Briggs
2020-03-30 17:34 ` Paul Moore
2020-03-30 17:49 ` Richard Guy Briggs
2020-03-30 19:55 ` Paul Moore
2020-04-16 20:33 ` Eric W. Biederman
2020-04-16 21:53 ` Paul Moore
2020-04-17 22:23 ` Eric W. Biederman
2020-04-22 17:24 ` Paul Moore
2020-06-08 18:03 ` Richard Guy Briggs
2020-06-17 21:33 ` Paul Moore
2020-06-19 15:22 ` Richard Guy Briggs
2020-03-12 20:27 ` Richard Guy Briggs
2020-03-13 16:42 ` Paul Moore
2020-03-13 16:45 ` Steve Grubb
2020-03-13 16:49 ` Paul Moore
2020-03-13 19:23 ` Richard Guy Briggs
2020-03-18 21:01 ` Paul Moore
2020-03-18 21:41 ` Richard Guy Briggs
2020-03-18 21:47 ` Paul Moore
2020-03-19 21:47 ` Richard Guy Briggs
2020-03-20 21:56 ` Paul Moore
2020-03-25 12:29 ` Richard Guy Briggs
2020-03-29 3:17 ` Paul Moore
2020-03-30 15:23 ` Richard Guy Briggs
2019-12-31 19:48 ` [PATCH ghak90 V8 08/16] audit: add support for non-syscall auxiliary records Richard Guy Briggs
2019-12-31 19:48 ` [PATCH ghak90 V8 09/16] audit: add containerid support for user records Richard Guy Briggs
2019-12-31 19:48 ` [PATCH ghak90 V8 10/16] audit: add containerid filtering Richard Guy Briggs
2019-12-31 19:48 ` [PATCH ghak90 V8 11/16] audit: add support for containerid to network namespaces Richard Guy Briggs
2020-01-22 21:28 ` Paul Moore
2020-02-04 23:42 ` Richard Guy Briggs
2020-02-05 22:51 ` Paul Moore
2019-12-31 19:48 ` [PATCH ghak90 V8 12/16] audit: contid check descendancy and nesting Richard Guy Briggs
2020-01-22 21:29 ` Paul Moore
2020-01-23 21:02 ` Richard Guy Briggs
2020-01-23 21:47 ` Paul Moore
2019-12-31 19:48 ` [PATCH ghak90 V8 13/16] audit: track container nesting Richard Guy Briggs
2020-01-22 21:29 ` Paul Moore
2020-01-30 19:27 ` Richard Guy Briggs
2020-02-05 23:05 ` Paul Moore
2020-02-05 23:50 ` Richard Guy Briggs
2020-02-13 21:49 ` Paul Moore
2020-03-12 20:51 ` Richard Guy Briggs
2020-03-13 16:47 ` Paul Moore
2020-03-14 22:42 ` Richard Guy Briggs
2020-03-17 18:28 ` Richard Guy Briggs
2020-03-18 21:08 ` Paul Moore
2020-01-31 14:50 ` Steve Grubb
2020-02-04 13:19 ` Richard Guy Briggs
2020-02-04 15:47 ` Steve Grubb
2020-02-04 15:52 ` Paul Moore
2020-02-04 18:12 ` Steve Grubb
2020-02-05 22:57 ` Paul Moore
2019-12-31 19:48 ` [PATCH ghak90 V8 14/16] audit: check contid depth and add limit config param Richard Guy Briggs
2020-01-22 21:29 ` Paul Moore
2019-12-31 19:48 ` [PATCH ghak90 V8 15/16] audit: check contid count per netns and add config param limit Richard Guy Briggs
2020-01-22 21:29 ` Paul Moore
2019-12-31 19:48 ` [PATCH ghak90 V8 16/16] audit: add capcontid to set contid outside init_user_ns Richard Guy Briggs
2020-01-22 21:29 ` Paul Moore
2020-02-05 0:39 ` Richard Guy Briggs
2020-02-05 22:56 ` Paul Moore
2020-02-06 12:51 ` Richard Guy Briggs
2020-02-13 21:58 ` Paul Moore
2020-03-12 21:58 ` Richard Guy Briggs
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=3142237.YMNxv0uec1@x2 \
--to=sgrubb@redhat.com \
--cc=containers@lists.linux-foundation.org \
--cc=dhowells@redhat.com \
--cc=ebiederm@xmission.com \
--cc=eparis@parisplace.org \
--cc=linux-api@vger.kernel.org \
--cc=linux-audit@redhat.com \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mpatel@redhat.com \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=nhorman@tuxdriver.com \
--cc=paul@paul-moore.com \
--cc=rgb@redhat.com \
--cc=serge@hallyn.com \
--cc=simo@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).