Re: [PATCH] audit: listen in all network namespaces

On 07/17/2013 04:32 AM, Richard Guy Briggs wrote: I think it's the time for us to discuss if we should revert this commit, since this one prevent me from continuing to achieve audit namespace. The major problem is in kaudit_send_skb, we have no idea which audit sock the skb should send to. in this patch, there only is one auditd proecess, so the audit_sock is the only one. but when we have audit namespace. there will be multi audit socks. we have to store audit_sock into auditns(auditns will be passed to kauditd_send_skb), this will cause auditns have to get a reference of netns. and for some reason(netfilter audit target), netns will get reference of auditns too. this is terrible... So why not we revert this one, and use a very simple one to replace it? the below patch will save us from the refer to each other case, achieve the same effect. what's your opinion? Add a compare function which always return true for audit netlink socket, this will cause audit netlink sockets netns unaware, and no matter which netns the user space audit netlink sockets belong to, they all can find out and communicate with audit_sock. This gets rid of the necessary to create per-netns audit kernel side socket(audit_sock), it's pain to depend on and get reference of netns for auditns. Signed-off-by: Gao feng <gaofeng(a)cn.fujitsu.com&gt; --- kernel/audit.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/kernel/audit.c b/kernel/audit.c index 7b0e23a..468950b 100644 --- a/kernel/audit.c +++ b/kernel/audit.c @@ -886,12 +886,18 @@ static void audit_receive(struct sk_buff *skb) mutex_unlock(&audit_cmd_mutex); } +static bool audit_compare(struct net *net, struct sock *sk) +{ + return true; +} + /* Initialize audit support at boot time. */ static int __init audit_init(void) { int i; struct netlink_kernel_cfg cfg = { .input = audit_receive, + .compare = audit_compare, }; if (audit_initialized == AUDIT_DISABLED)