Re: [PATCH] audit: add nspid and nsppid in audit_log_task_info

[forwarding to 2 people looking at audit now, do you mind resending to linux-audit(a)redhat.com and inluding them both?]

On Sat, 2014-11-22 at 13:53 -0500, Mark Ellzey wrote: > If the current task being sent to audit_log_task_info() is not within > the root namespace, add two new fields "nspid=X nsppid=Y". > > This allows a user to map the real pid/ppid to a namespaced pid/ppid. > --- > > kernel/audit.c | 12 ++++++++++++ > 1 file changed, 12 insertions(+) > > diff --git a/kernel/audit.c b/kernel/audit.c > index cebb11d..5439f66 100644 > --- a/kernel/audit.c > +++ b/kernel/audit.c > @@ -1853,6 +1853,7 @@ void audit_log_task_info(struct audit_buffer > *ab, struct task_struct *tsk) > > char comm[sizeof(tsk->comm)]; > struct mm_struct *mm = tsk->mm; > char *tty; > > + struct pid_namespace * pns; > > if (!ab) > return; > > @@ -1865,8 +1866,19 @@ void audit_log_task_info(struct audit_buffer > *ab, struct task_struct *tsk) > > tty = tsk->signal->tty->name; > else > tty = "(none)"; > > + > > spin_unlock_irq(&tsk->sighand->siglock); > > + if ((pns = task_active_pid_ns(tsk)) != &init_pid_ns) { > + pid_t nsppid = 0; > + pid_t nspid = 0; > + > + nsppid = task_ppid_nr_ns(tsk, pns); > + nspid = task_pid_nr_ns(tsk, pns); > + > + audit_log_format(ab, " nsppid=%d nspid=%d", nsppid, nspid); > + } > + > > audit_log_format(ab, > " ppid=%d pid=%d auid=%u uid=%u gid=%u" > " euid=%u suid=%u fsuid=%u" > > -- > 1.9.1