Re: [PATCH] audit: listen in all network namespaces

On Thu, 2013-12-19 at 11:59 +0800, Gao feng wrote: > On 07/17/2013 04:32 AM, Richard Guy Briggs wrote: >> Convert audit from only listening in init_net to use register_pernet_subsys() >> to dynamically manage the netlink socket list. >> >> Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com&gt; >> --- > > I think it's the time for us to discuss if we should revert this > commit, since this one prevent me from continuing to achieve > audit namespace. > > > The major problem is in kaudit_send_skb, we have no idea which > audit sock the skb should send to. right, we have problems here no matter what... If we stick with the current approach you will need to know socket + portid. With your approach one only needs to know portid. Since these are can both be part of the audit_ns structure I don't see a huge difference... > we have to store audit_sock > into auditns(auditns will be passed to kauditd_send_skb), > this will cause auditns have to get a reference of netns. > and for some reason(netfilter audit target), netns will > get reference of auditns too. this is terrible... I'm not sure I agree/understand this entirely...