On Wed, Feb 10, 2016 at 9:30 PM, Richard Guy Briggs <rgb(a)redhat.com> wrote:
There is also planning to be done to allow one auditd per user
namespace to support containers, but we aren't there yet.
To add to that, we will also provide better support for containers
with a single auditd instance (the microservices case) by providing
better marking of audit records to help indicate which namespace set
(what the kernel would consider a container) generated the audit
event.
--
paul moore
www.paul-moore.com