From: Topi Miettinen <toiwoton@gmail.com>
To: Tejun Heo <tj@kernel.org>
Cc: linux-kernel@vger.kernel.org, ebiederm@xmission.com,
pmladek@suse.com, luto@kernel.org, serge@hallyn.com,
keescook@chromium.org, Paul Moore <paul@paul-moore.com>,
Eric Paris <eparis@redhat.com>, Li Zefan <lizefan@huawei.com>,
Johannes Weiner <hannes@cmpxchg.org>,
"moderated list:AUDIT SUBSYSTEM" <linux-audit@redhat.com>,
"open list:CONTROL GROUP (CGROUP)" <cgroups@vger.kernel.org>,
"open list:CAPABILITIES" <linux-security-module@vger.kernel.org>
Subject: Re: [PATCH] capabilities: audit capability use
Date: Wed, 13 Jul 2016 06:52:06 +0000 [thread overview]
Message-ID: <687b82c6-0e66-0ff1-30f1-a1d60f40f624@gmail.com> (raw)
In-Reply-To: <20160712145936.GH3190@htj.duckdns.org>
On 07/12/16 14:59, Tejun Heo wrote:
> On Mon, Jul 11, 2016 at 07:47:44PM +0000, Topi Miettinen wrote:
>> It's really critical to be able to associate a task in the logs to
>> cgroups which were valid that time. Or can we infer somehow what cgroups
>
> When is "that time"? Without logging all operations, this is
> meaningless.
>
>> a task was taking part, long time after task exit? Perhaps task cgroup
>> membership changes and changes in available cgroups should be logged too?
>>
>> Some kind of cgroup IDs could be logged instead of long paths. Then
>> these IDs should be reliably resolvable to paths offline somehow.
>
> I don't think that's doable. That pretty much requires the kernel to
> remember paths of all past cgroups.
That's a show stopper for audit approach for getting helpful information
for configuration. I'll try something different, probably cgroupstats.
-Topi
>
>> How usual migrations between cgroups are? Why would a task ever move
>> from (say) systemd/system.slice/smartd.service to anywhere else?
>
> In most cases, they won't move once set up initially but that's not
> the point of audit subsystem. Logging this once one exit isn't gonna
> help anything for auditing the system.
>
> Thanks.
>
next prev parent reply other threads:[~2016-07-13 6:52 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-07-11 11:14 [PATCH] capabilities: audit capability use Topi Miettinen
2016-07-11 15:25 ` Serge E. Hallyn
2016-07-11 16:05 ` Topi Miettinen
2016-07-11 19:28 ` Topi Miettinen
2016-07-11 17:09 ` Tejun Heo
2016-07-11 19:47 ` Topi Miettinen
2016-07-12 14:59 ` Tejun Heo
2016-07-13 6:52 ` Topi Miettinen [this message]
2016-07-11 21:57 ` Eric W. Biederman
2016-07-12 8:54 ` Topi Miettinen
2016-07-12 13:16 ` Eric W. Biederman
2016-07-12 22:00 ` Paul Moore
2016-07-13 7:30 ` Topi Miettinen
2016-07-12 21:56 ` Paul Moore
-- strict thread matches above, loose matches on Subject: below --
2016-07-03 15:08 [PATCH] capabilities: add capability cgroup controller Topi Miettinen
2016-07-03 16:13 ` [PATCH] capabilities: audit capability use kbuild test robot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=687b82c6-0e66-0ff1-30f1-a1d60f40f624@gmail.com \
--to=toiwoton@gmail.com \
--cc=cgroups@vger.kernel.org \
--cc=ebiederm@xmission.com \
--cc=eparis@redhat.com \
--cc=hannes@cmpxchg.org \
--cc=keescook@chromium.org \
--cc=linux-audit@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=lizefan@huawei.com \
--cc=luto@kernel.org \
--cc=paul@paul-moore.com \
--cc=pmladek@suse.com \
--cc=serge@hallyn.com \
--cc=tj@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).