Re: [PATCH V5 09/13] fork: audit on creation of new namespace(s)

When clone(2) is called to fork a new process creating one or more namespaces, audit the event to tie the new pid with the namespace IDs. Signed-off-by: Richard Guy Briggs

--- kernel/fork.c | 3 +++ kernel/nsproxy.c | 1 + 2 files changed, 4 insertions(+), 0 deletions(-) diff --git a/kernel/fork.c b/kernel/fork.c index 6a13c46..a7fe4d5 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -1624,6 +1624,9 @@ long do_fork(unsigned long clone_flags, get_task_struct(p); } + if (unlikely(clone_flags & CLONE_NEW_MASK)) { + audit_log_ns_info(p); + } wake_up_new_task(p); /* forking complete and child started to run, tell ptracer */ diff --git a/kernel/nsproxy.c b/kernel/nsproxy.c index 0c2f25e..2cdc16b 100644 --- a/kernel/nsproxy.c +++ b/kernel/nsproxy.c @@ -25,6 +25,7 @@ #include <linux/proc_ns.h> #include <linux/file.h> #include <linux/syscalls.h> +#include <linux/audit.h> static struct kmem_cache *nsproxy_cachep; -- 1.7.1