Messages in this thread | | | Subject | Re: [PATCH ghak90 (was ghak32) V4 03/10] audit: log container info of syscalls | From | Casey Schaufler <> | Date | Fri, 26 Oct 2018 01:09:16 -0700 |
| |
On 10/25/2018 2:55 PM, Steve Grubb wrote: > ... > And historically speaking setting audit loginuid produces a LOGIN > event, so it only makes sense to consider binding container ID to > container as a CONTAINER event. For other supplemental records, we name > things what they are: PATH, CWD, SOCKADDR, etc. So, CONTAINER_ID makes > sense. CONTAINER_OP sounds like its for operations on a container. Do > we have any operations on a container?
The answer has to be "no", because containers are, by emphatic assertion, not kernel constructs. Any CONTAINER_OP event has to come from user space. I think.
| |