Re: [PATCH RFC 00/48] Add namespace support for audit

On 05/07/2013 10:20 AM, Gao feng wrote: > This patchset try to add namespace support for audit. > > I choose to assign audit to the user namespace. > Right now,there are six kinds of namespaces, such as > net, mount, ipc, pid, uts and user. the first five > namespaces have special usage. the audit isn't suitable to > belong to these five namespaces, so the user namespace > may be the best choice. > > Through I decide to make audit related resources per user > namespace, but audit uses netlink to communicate between kernel > space and user space, and the netlink is a private resource > of per net namespace. So we need the capability to allow the > netlink sockets to communicate with each other in the same user > namespace even they are in different net namespace. [PATCH 2/48] > does this job, it adds a new function "compare" for per netlink > table to compare two sockets. it means the netlink protocols can > has its own compare fuction, For other protocols, two netlink > sockets are different if they belong to the different net namespace. > For audit protocol, two sockets can be the same even they in different > net namespace,we use user namespace not net namespace to make the > decision. > > There is one point that some people may dislike,in [PATCH 1/48], > the kernel side audit netlink socket is created only when we create > the first netns for the userns, and this userns will hold the netns > until we destroy this userns. > > The other patches just make the audit related resources per > user namespace. > > This patchset is sent as an RFC,any comments are welcome.