On Sunday, November 23, 2014 09:58:48 AM Eric Paris wrote: > [forwarding to 2 people looking at audit now, do you mind resending to > linux-audit(a)redhat.com and inluding them both?] I'm also adding the linux-audit list to the CC line. I know Richard has been working on namespaces/audit, I'd like to hear his comments on this patch.

> On Sat, 2014-11-22 at 13:53 -0500, Mark Ellzey wrote: > > If the current task being sent to audit_log_task_info() is not within > > the root namespace, add two new fields "nspid=X nsppid=Y". > > > > This allows a user to map the real pid/ppid to a namespaced pid/ppid. > > --- > > > > kernel/audit.c | 12 ++++++++++++ > > 1 file changed, 12 insertions(+) > > > > diff --git a/kernel/audit.c b/kernel/audit.c > > index cebb11d..5439f66 100644 > > --- a/kernel/audit.c > > +++ b/kernel/audit.c > > @@ -1853,6 +1853,7 @@ void audit_log_task_info(struct audit_buffer > > *ab, struct task_struct *tsk) > > > > char comm[sizeof(tsk->comm)]; > > struct mm_struct *mm = tsk->mm; > > char *tty; > > > > + struct pid_namespace * pns; > > > > if (!ab) > > return; > > > > @@ -1865,8 +1866,19 @@ void audit_log_task_info(struct audit_buffer > > *ab, struct task_struct *tsk) > > > > tty = tsk->signal->tty->name; > > else > > tty = "(none)"; > > > > + > > > > spin_unlock_irq(&tsk->sighand->siglock); > > > > + if ((pns = task_active_pid_ns(tsk)) != &init_pid_ns) { > > + pid_t nsppid = 0; > > + pid_t nspid = 0; > > + > > + nsppid = task_ppid_nr_ns(tsk, pns); > > + nspid = task_pid_nr_ns(tsk, pns); > > + > > + audit_log_format(ab, " nsppid=%d nspid=%d", nsppid, nspid); > > + } > > + > > > > audit_log_format(ab, > > " ppid=%d pid=%d auid=%u uid=%u gid=%u" > > " euid=%u suid=%u fsuid=%u" > > > > -- > > 1.9.1 paul moore