lkml.org 
[lkml]   [2013]   [Nov]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [RFC Part1 PATCH 00/20 v2] Add namespace support for audit
    Ping...

    On 10/31/2013 11:52 AM, Gao feng wrote:
    > Hi Eric Paris,
    >
    > Can you give me some comments?
    >
    > You think the tying audit namespace to user namespace is a bad idea,
    > so this patchset doesn't assign auditns to userns and introduce an
    > new audit netlink type to help to create audit namespace.
    >
    > and this patchset also introduces an new proc interface to make
    > sure container can't influence the whole system.
    >
    > and the audit rules are not namespace aware, all of audit namespaces
    > should comply with the rules. in next step, if we find it's need to
    > make audit rules per audit namespace, then it's the time to do that
    > job.
    >
    > This patchset also makes all of net namespaces have ability to send/
    > receive audit netlink message.
    >
    > I may miss some points, if you find there are some shortage or loophole,
    > please let me know.
    >
    > Thanks!
    >
    > On 10/24/2013 03:31 PM, Gao feng wrote:
    >> Here is the v1 patchset: http://lwn.net/Articles/549546/
    >>
    >> The main target of this patchset is allowing user in audit
    >> namespace to generate the USER_MSG type of audit message,
    >> some userspace tools need to generate audit message, or
    >> these tools will broken.
    >>
    >> And the login process in container may want to setup
    >> /proc/<pid>/loginuid, right now this value is unalterable
    >> once it being set. this will also broke the login problem
    >> in container. After this patchset, we can reset this loginuid
    >> to zero if task is running in a new audit namespace.
    >>
    >> Same with v1 patchset, in this patchset, only the privileged
    >> user in init_audit_ns and init_user_ns has rights to
    >> add/del audit rules. and these rules are gloabl. all
    >> audit namespace will comply with the rules.
    >>
    >> Compared with v1, v2 patch has some big changes.
    >> 1, the audit namespace is not assigned to user namespace.
    >> since there is no available bit of flags for clone, we
    >> create audit namespace through netlink, patch[18/20]
    >> introduces a new audit netlink type AUDIT_CREATE_NS.
    >> the privileged user in userns has rights to create a
    >> audit namespace, it means the unprivileged user can
    >> create auditns through create userns first. In order
    >> to prevent them from doing harm to host, the default
    >> audit_backlog_limit of un-init-audit-ns is zero(means
    >> audit is unavailable in audit namespace). and it can't
    >> be changed in auditns through netlink.
    >>
    >> 2, introduce /proc/<pid>/audit_log_limit
    >> this interface is used to setup log_limit of audit
    >> namespace. we need this interface to make audit
    >> available in un-init-audit-ns. Only the privileged user
    >> has right to set this value, it means only the root user
    >> of host can change it.
    >>
    >> 3, make audit namespace don't depend on net namespace.
    >> patch[1/20] add a compare function audit_compare for
    >> audit netlink, it always return true, it means the
    >> netlink subsystem will find out the netlink socket
    >> only through portid and netlink type. So we needn't
    >> to create kernel side audit netlink socket for per
    >> net namespace, all userspace audit netlink socket
    >> can find out the audit_sock, and audit_sock can
    >> communicate with them through the proper portid.
    >> it's just like the behavior we don't have net
    >> namespace before.
    >>
    >>
    >> This patchset still need some work, such as allow changing
    >> audit_enabled in audit namespace, auditd wants this feature.
    >>
    >> I send this patchset now in order to get more comments, so
    >> I can keep on improving namespace support for audit.
    >>
    >> Gao feng (20):
    >> Audit: make audit netlink socket net namespace unaware
    >> audit: introduce configure option CONFIG_AUDIT_NS
    >> audit: make audit_skb_queue per audit namespace
    >> audit: make audit_skb_hold_queue per audit namespace
    >> audit: make audit_pid per audit namespace
    >> audit: make kauditd_task per audit namespace
    >> aduit: make audit_nlk_portid per audit namespace
    >> audit: make kaudit_wait queue per audit namespace
    >> audit: make audit_backlog_wait per audit namespace
    >> audit: allow un-init audit ns to change pid and portid only
    >> audit: use proper audit namespace in audit_receive_msg
    >> audit: use proper audit_namespace in kauditd_thread
    >> audit: introduce new audit logging interface for audit namespace
    >> audit: pass proper audit namespace to audit_log_common_recv_msg
    >> audit: Log audit pid config change in audit namespace
    >> audit: allow GET,SET,USER MSG operations in audit namespace
    >> nsproxy: don't make create_new_namespaces static
    >> audit: add new message type AUDIT_CREATE_NS
    >> audit: make audit_backlog_limit per audit namespace
    >> audit: introduce /proc/<pid>/audit_backlog_limit
    >>
    >> fs/proc/base.c | 53 ++++++
    >> include/linux/audit.h | 26 ++-
    >> include/linux/audit_namespace.h | 92 ++++++++++
    >> include/linux/nsproxy.h | 15 +-
    >> include/uapi/linux/audit.h | 1 +
    >> init/Kconfig | 10 ++
    >> kernel/Makefile | 2 +-
    >> kernel/audit.c | 364 +++++++++++++++++++++++++---------------
    >> kernel/audit.h | 5 +-
    >> kernel/audit_namespace.c | 123 ++++++++++++++
    >> kernel/auditsc.c | 6 +-
    >> kernel/nsproxy.c | 18 +-
    >> 12 files changed, 561 insertions(+), 154 deletions(-)
    >> create mode 100644 include/linux/audit_namespace.h
    >> create mode 100644 kernel/audit_namespace.c
    >>
    >
    >



    \
     
     \ /
      Last update: 2013-11-05 09:21    [W:4.051 / U:0.088 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site