Re: [PATCH ghak90 V6 02/10] audit: add container id

On 2019-05-30 19:26, Paul Moore wrote:

> I like the creativity, but I worry that at some point these > limitations are going to be raised (limits have a funny way of doing > that over time) and we will be in trouble. I say "trouble" because I > want to be able to quickly do an audit container ID comparison and > we're going to pay a penalty for these larger values (we'll need this > when we add multiple auditd support and the requisite record routing). > > Thinking about this makes me also realize we probably need to think a > bit longer about audit container ID conflicts between orchestrators. > Right now we just take the value that is given to us by the > orchestrator, but if we want to allow multiple container orchestrators > to work without some form of cooperation in userspace (I think we have > to assume the orchestrators will not talk to each other) we likely > need to have some way to block reuse of an audit container ID. We > would either need to prevent the orchestrator from explicitly setting > an audit container ID to a currently in use value, or instead generate > the audit container ID in the kernel upon an event triggered by the > orchestrator (e.g. a write to a /proc file). I suspect we should > start looking at the idr code, I think we will need to make use of it. To address this, I'd suggest that it is enforced to only allow the setting of descendants and to maintain a master list of audit container identifiers (with a hash table if necessary later) that includes the container owner.