lkml.org 
[lkml]   [2019]   [Apr]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH ghak90 V6 00/10] audit: implement container identifier
    On Mon, Apr 22, 2019 at 09:49:05AM -0400, Paul Moore wrote:
    > On Mon, Apr 22, 2019 at 7:38 AM Neil Horman <nhorman@tuxdriver.com> wrote:
    > > On Mon, Apr 08, 2019 at 11:39:07PM -0400, Richard Guy Briggs wrote:
    > > > Implement kernel audit container identifier.
    > >
    > > I'm sorry, I've lost track of this, where have we landed on it? Are we good for
    > > inclusion?
    >
    > I haven't finished going through this latest revision, but unless
    > Richard made any significant changes outside of the feedback from the
    > v5 patchset I'm guessing we are "close".
    >
    > Based on discussions Richard and I had some time ago, I have always
    > envisioned the plan as being get the kernel patchset, tests, docs
    > ready (which Richard has been doing) and then run the actual
    > implemented API by the userland container folks, e.g. cri-o/lxc/etc.,
    > to make sure the actual implementation is sane from their perspective.
    > They've already seen the design, so I'm not expecting any real
    > surprises here, but sometimes opinions change when they have actual
    > code in front of them to play with and review.
    >
    > Beyond that, while the cri-o/lxc/etc. folks are looking it over,
    > whatever additional testing we can do would be a big win. I'm
    > thinking I'll pull it into a separate branch in the audit tree
    > (audit/working-container ?) and include that in my secnext kernels
    > that I build/test on a regular basis; this is also a handy way to keep
    > it based against the current audit/next branch. If any changes are
    > needed Richard can either chose to base those changes on audit/next or
    > the separate audit container ID branch; that's up to him. I've done
    > this with other big changes in other trees, e.g. SELinux, and it has
    > worked well to get some extra testing in and keep the patchset "merge
    > ready" while others outside the subsystem look things over.
    >

    That all sounds good, thank you Paul. I knew you and Richard were working on
    it, but I somehow managed to loose track of exactly where we left this.

    Much Appreciated
    Neil

    > --
    > paul moore
    > www.paul-moore.com
    >

    \
     
     \ /
      Last update: 2019-04-23 12:30    [W:4.055 / U:0.276 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site