Messages in this thread Patch in this message | | | From | Richard Guy Briggs <> | Subject | [PATCH V6 06/10] audit: dump namespace IDs for pid on receipt of AUDIT_NS_INFO | Date | Fri, 17 Apr 2015 03:35:53 -0400 |
| |
When a task with CAP_AUDIT_CONTROL sends a NETLINK_AUDIT message of type AUDIT_NS_INFO with a PID of interest, dump the namespace IDs of that task to the audit log.
Signed-off-by: Richard Guy Briggs <rgb@redhat.com> --- kernel/audit.c | 14 ++++++++++++++ 1 files changed, 14 insertions(+), 0 deletions(-)
diff --git a/kernel/audit.c b/kernel/audit.c index e6230c4..b7f10e9 100644 --- a/kernel/audit.c +++ b/kernel/audit.c @@ -674,6 +674,7 @@ static int audit_netlink_ok(struct sk_buff *skb, u16 msg_type) case AUDIT_TTY_SET: case AUDIT_TRIM: case AUDIT_MAKE_EQUIV: + case AUDIT_NS_INFO: /* Only support auditd and auditctl in initial pid namespace * for now. */ if (task_active_pid_ns(current) != &init_pid_ns) @@ -1070,6 +1071,19 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh) audit_log_end(ab); break; } + case AUDIT_NS_INFO: +#ifdef CONFIG_NAMESPACES + { + struct task_struct *tsk; + + rcu_read_lock(); + tsk = find_task_by_vpid(*(pid_t *)data); + rcu_read_unlock(); + audit_log_ns_info(tsk); + } +#else /* CONFIG_NAMESPACES */ + err = -EOPNOTSUPP; +#endif /* CONFIG_NAMESPACES */ default: err = -EINVAL; break; -- 1.7.1
| |