Re: [RFC Part1 PATCH 00/20 v2] Add namespace support for audit

Ping...

On 10/31/2013 11:52 AM, Gao feng wrote: > Hi Eric Paris, > > Can you give me some comments? > > You think the tying audit namespace to user namespace is a bad idea, > so this patchset doesn't assign auditns to userns and introduce an > new audit netlink type to help to create audit namespace. > > and this patchset also introduces an new proc interface to make > sure container can't influence the whole system. > > and the audit rules are not namespace aware, all of audit namespaces > should comply with the rules. in next step, if we find it's need to > make audit rules per audit namespace, then it's the time to do that > job. > > This patchset also makes all of net namespaces have ability to send/ > receive audit netlink message. > > I may miss some points, if you find there are some shortage or loophole, > please let me know. > > Thanks! > > On 10/24/2013 03:31 PM, Gao feng wrote: >> Here is the v1 patchset: http://lwn.net/Articles/549546/ >> >> The main target of this patchset is allowing user in audit >> namespace to generate the USER_MSG type of audit message, >> some userspace tools need to generate audit message, or >> these tools will broken. >> >> And the login process in container may want to setup >> /proc/<pid>/loginuid, right now this value is unalterable >> once it being set. this will also broke the login problem >> in container. After this patchset, we can reset this loginuid >> to zero if task is running in a new audit namespace. >> >> Same with v1 patchset, in this patchset, only the privileged >> user in init_audit_ns and init_user_ns has rights to >> add/del audit rules. and these rules are gloabl. all >> audit namespace will comply with the rules. >> >> Compared with v1, v2 patch has some big changes. >> 1, the audit namespace is not assigned to user namespace. >> since there is no available bit of flags for clone, we >> create audit namespace through netlink, patch[18/20] >> introduces a new audit netlink type AUDIT_CREATE_NS. >> the privileged user in userns has rights to create a >> audit namespace, it means the unprivileged user can >> create auditns through create userns first. In order >> to prevent them from doing harm to host, the default >> audit_backlog_limit of un-init-audit-ns is zero(means >> audit is unavailable in audit namespace). and it can't >> be changed in auditns through netlink. >> >> 2, introduce /proc/<pid>/audit_log_limit >> this interface is used to setup log_limit of audit >> namespace. we need this interface to make audit >> available in un-init-audit-ns. Only the privileged user >> has right to set this value, it means only the root user >> of host can change it. >> >> 3, make audit namespace don't depend on net namespace. >> patch[1/20] add a compare function audit_compare for >> audit netlink, it always return true, it means the >> netlink subsystem will find out the netlink socket >> only through portid and netlink type. So we needn't >> to create kernel side audit netlink socket for per >> net namespace, all userspace audit netlink socket >> can find out the audit_sock, and audit_sock can >> communicate with them through the proper portid. >> it's just like the behavior we don't have net >> namespace before. >> >> >> This patchset still need some work, such as allow changing >> audit_enabled in audit namespace, auditd wants this feature. >> >> I send this patchset now in order to get more comments, so >> I can keep on improving namespace support for audit. >> >> Gao feng (20): >> Audit: make audit netlink socket net namespace unaware >> audit: introduce configure option CONFIG_AUDIT_NS >> audit: make audit_skb_queue per audit namespace >> audit: make audit_skb_hold_queue per audit namespace >> audit: make audit_pid per audit namespace >> audit: make kauditd_task per audit namespace >> aduit: make audit_nlk_portid per audit namespace >> audit: make kaudit_wait queue per audit namespace >> audit: make audit_backlog_wait per audit namespace >> audit: allow un-init audit ns to change pid and portid only >> audit: use proper audit namespace in audit_receive_msg >> audit: use proper audit_namespace in kauditd_thread >> audit: introduce new audit logging interface for audit namespace >> audit: pass proper audit namespace to audit_log_common_recv_msg >> audit: Log audit pid config change in audit namespace >> audit: allow GET,SET,USER MSG operations in audit namespace >> nsproxy: don't make create_new_namespaces static >> audit: add new message type AUDIT_CREATE_NS >> audit: make audit_backlog_limit per audit namespace >> audit: introduce /proc/<pid>/audit_backlog_limit >> >> fs/proc/base.c | 53 ++++++ >> include/linux/audit.h | 26 ++- >> include/linux/audit_namespace.h | 92 ++++++++++ >> include/linux/nsproxy.h | 15 +- >> include/uapi/linux/audit.h | 1 + >> init/Kconfig | 10 ++ >> kernel/Makefile | 2 +- >> kernel/audit.c | 364 +++++++++++++++++++++++++--------------- >> kernel/audit.h | 5 +- >> kernel/audit_namespace.c | 123 ++++++++++++++ >> kernel/auditsc.c | 6 +- >> kernel/nsproxy.c | 18 +- >> 12 files changed, 561 insertions(+), 154 deletions(-) >> create mode 100644 include/linux/audit_namespace.h >> create mode 100644 kernel/audit_namespace.c >> > >