Re: [PATCH ghak90 (was ghak32) V4 04/10] audit: add containerid support for ptrace and signals

Add audit container identifier support to ptrace and signals. In particular, the "op" field provides a way to label the auxiliary record to which it is associated. Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com&gt; Acked-by: Serge Hallyn <serge(a)hallyn.com&gt; --- include/linux/audit.h | 11 +++++------ kernel/audit.c | 13 +++++++------ kernel/audit.h | 2 ++ kernel/auditsc.c | 21 ++++++++++++++++----- 4 files changed, 30 insertions(+), 17 deletions(-)

@@ -155,9 +156,8 @@ extern void audit_log_key(struct audit_buffer *ab, extern int audit_log_task_context(struct audit_buffer *ab); extern void audit_log_task_info(struct audit_buffer *ab, struct task_struct *tsk); -extern int audit_log_contid(struct task_struct *tsk, - struct audit_context *context, - char *op); +extern int audit_log_contid(struct audit_context *context, + char *op, u64 contid); extern int audit_update_lsm_rules(void);

@@ -2047,23 +2049,22 @@ void audit_log_session_info(struct audit_buffer *ab) /* * audit_log_contid - report container info - * @tsk: task to be recorded * @context: task or local context for record * @op: contid string description + * @contid: container ID to report */ -int audit_log_contid(struct task_struct *tsk, - struct audit_context *context, char *op) +int audit_log_contid(struct audit_context *context, + char *op, u64 contid) { struct audit_buffer *ab; - if (!audit_contid_set(tsk)) + if (!audit_contid_valid(contid)) return 0; /* Generate AUDIT_CONTAINER record with container ID */ ab = audit_log_start(context, GFP_KERNEL, AUDIT_CONTAINER); if (!ab) return -ENOMEM; - audit_log_format(ab, "op=%s contid=%llu", - op, audit_get_contid(tsk)); + audit_log_format(ab, "op=%s contid=%llu", op, contid); audit_log_end(ab); return 0; }