Re: [PATCH] audit: don't attempt to lookup PIDs when changing PID filtering audit rules
On Monday, December 15, 2014 12:29:52 PM Eric Paris wrote:
Lets say I and in the non-init pid namespace.
I run audictl -a exit,always -S all -F pid=1
Is the audit system going to show records for what I think is pid=1 or
what the initial pid namespace thinks is pid=1 ?
The initial namespace. If we want the executing task's current namespace we
should probably change audit_filter_user_rules().
Which is correct? (hint, it's impossible to know pids above my
namespace, or even to know what pid the process in question thinks it
is, since it could be below my namespace)
Heh. I'm sorry, I tend to laugh when I hear the term "correct" during an
audit discussion ;)
Steve, Richard, Eric - what do you guys want: initial or current namespace?
I won't pretend this is easy to solve.
Steve et al. What do you think of maybe having pid= rules automatically
removed when the pid goes away? I can't think of another way to handle
this (although the perf hit might be so stupidly high....)
I'm personally not super excited about rules disappearing automatically and I
also believe that it should be possible to remove a rule regardless (not being
able to remove a PID filtering rule due to the status of the associated task
is silly).
--
paul moore
security and virtualization @ redhat