From: Richard Guy Briggs <rgb@redhat.com>
To: Paul Moore <paul@paul-moore.com>
Cc: Jens Axboe <axboe@kernel.dk>, Neil Horman <nhorman@tuxdriver.com>,
Linux API <linux-api@vger.kernel.org>,
Linux Containers List <containers@lists.linux-foundation.org>,
LKML <linux-kernel@vger.kernel.org>,
David Howells <dhowells@redhat.com>,
Linux-Audit Mailing List <linux-audit@redhat.com>,
Netfilter Devel List <netfilter-devel@vger.kernel.org>,
"Eric W. Biederman" <ebiederm@xmission.com>,
Simo Sorce <simo@redhat.com>,
Linux NetDev Upstream Mailing List <netdev@vger.kernel.org>,
Linux FSdevel <linux-fsdevel@vger.kernel.org>,
Eric Paris <eparis@parisplace.org>,
mpatel@redhat.com
Subject: Re: [PATCH ghak90 v10 01/11] audit: collect audit task parameters
Date: Mon, 21 Dec 2020 12:57:12 -0500 [thread overview]
Message-ID: <20201221175712.GI1762914@madcap2.tricolour.ca> (raw)
In-Reply-To: <CAHC9VhSTuBJ3LXxMY=nD7qBzmKLDjXY0V3hsuN34_siq_xRrig@mail.gmail.com>
On 2020-12-21 12:14, Paul Moore wrote:
> On Mon, Dec 21, 2020 at 11:57 AM Richard Guy Briggs <rgb@redhat.com> wrote:
> >
> > The audit-related parameters in struct task_struct should ideally be
> > collected together and accessed through a standard audit API and the audit
> > structures made opaque to other kernel subsystems.
> >
> > Collect the existing loginuid, sessionid and audit_context together in a
> > new opaque struct audit_task_info called "audit" in struct task_struct.
> >
> > Use kmem_cache to manage this pool of memory.
> > Un-inline audit_free() to be able to always recover that memory.
> >
> > Please see the upstream github issues
> > https://github.com/linux-audit/audit-kernel/issues/81
> > https://github.com/linux-audit/audit-kernel/issues/90
> >
> > Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
> > Acked-by: Neil Horman <nhorman@tuxdriver.com>
> > Reviewed-by: Ondrej Mosnacek <omosnace@redhat.com>
>
> Did Neil and Ondrej really ACK/Review the changes that you made here
> in v10 or are you just carrying over the ACK/Review? I'm hopeful it
> is the former, because I'm going to be a little upset if it is the
> latter.
It is the latter, sorry. So, this needs to be reposted without their
ACK/Review lines.
> > ---
> > fs/io-wq.c | 8 +--
> > fs/io_uring.c | 16 ++---
> > include/linux/audit.h | 49 +++++---------
> > include/linux/sched.h | 7 +-
> > init/init_task.c | 3 +-
> > init/main.c | 2 +
> > kernel/audit.c | 154 +++++++++++++++++++++++++++++++++++++++++-
> > kernel/audit.h | 7 ++
> > kernel/auditsc.c | 24 ++++---
> > kernel/fork.c | 1 -
> > 10 files changed, 205 insertions(+), 66 deletions(-)
>
> --
> paul moore
> www.paul-moore.com
>
- RGB
--
Richard Guy Briggs <rgb@redhat.com>
Sr. S/W Engineer, Kernel Security, Base Operating Systems
Remote, Ottawa, Red Hat Canada
IRC: rgb, SunRaycer
Voice: +1.647.777.2635, Internal: (81) 32635
_______________________________________________
Containers mailing list
Containers@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/containers
next prev parent reply other threads:[~2020-12-21 17:57 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-12-21 16:55 [PATCH ghak90 v10 00/11] audit: implement container identifier Richard Guy Briggs
2020-12-21 16:55 ` [PATCH ghak90 v10 01/11] audit: collect audit task parameters Richard Guy Briggs
2020-12-21 17:14 ` Paul Moore
2020-12-21 17:57 ` Richard Guy Briggs [this message]
2020-12-21 16:55 ` [PATCH ghak90 v10 02/11] audit: add container id Richard Guy Briggs
2020-12-21 16:55 ` [PATCH ghak90 v10 03/11] audit: log container info of syscalls Richard Guy Briggs
2020-12-21 16:55 ` [PATCH ghak90 v10 04/11] audit: add contid support for signalling the audit daemon Richard Guy Briggs
2020-12-21 16:55 ` [PATCH ghak90 v10 05/11] audit: add support for non-syscall auxiliary records Richard Guy Briggs
2020-12-21 16:55 ` [PATCH ghak90 v10 06/11] audit: add containerid support for user records Richard Guy Briggs
2020-12-21 16:55 ` [PATCH ghak90 v10 07/11] audit: add containerid filtering Richard Guy Briggs
2020-12-21 16:55 ` [PATCH ghak90 v10 08/11] audit: add support for containerid to network namespaces Richard Guy Briggs
2020-12-21 16:55 ` [PATCH ghak90 v10 09/11] audit: contid check descendancy and nesting Richard Guy Briggs
2020-12-21 16:55 ` [PATCH ghak90 v10 10/11] audit: track container nesting Richard Guy Briggs
2020-12-21 16:55 ` [PATCH ghak90 v10 11/11] audit: add capcontid to set contid outside init_user_ns Richard Guy Briggs
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201221175712.GI1762914@madcap2.tricolour.ca \
--to=rgb@redhat.com \
--cc=axboe@kernel.dk \
--cc=containers@lists.linux-foundation.org \
--cc=dhowells@redhat.com \
--cc=ebiederm@xmission.com \
--cc=eparis@parisplace.org \
--cc=linux-api@vger.kernel.org \
--cc=linux-audit@redhat.com \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mpatel@redhat.com \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=nhorman@tuxdriver.com \
--cc=paul@paul-moore.com \
--cc=simo@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).