Date: Tue, 11 Jun 2013 09:15:37 -0500
From: "Serge E. Hallyn" <serge@hallyn.com>
To: Eric Paris <eparis@redhat.com>
Cc: Gao feng <gaofeng@cn.fujitsu.com>, "Serge E. Hallyn" <serge@hallyn.com>,
        Serge Hallyn <serge.hallyn@ubuntu.com>,
        containers@lists.linux-foundation.org, linux-kernel@vger.kernel.org,
        linux-audit@redhat.com, ebiederm@xmission.com, davem@davemloft.net
Subject: Re: [PATCH RFC 00/48] Add namespace support for audit
Message-ID: <20130611141537.GA30294@austin.hallyn.com>
References: <1367893269-9308-1-git-send-email-gaofeng@cn.fujitsu.com>
 <519B3B4E.1070405@cn.fujitsu.com>
 <20130606215255.GA28978@tp>
 <20130606224710.GA30502@tp>
 <51B531CC.2020604@cn.fujitsu.com>
 <20130610212437.GA11940@austin.hallyn.com>
 <51B6BCBE.7060608@cn.fujitsu.com>
 <1370958597.29545.11.camel@localhost>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <1370958597.29545.11.camel@localhost>
User-Agent: Mutt/1.5.21 (2010-09-15)
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 2400
Lines: 49

Quoting Eric Paris (eparis@redhat.com):
> On Tue, 2013-06-11 at 13:59 +0800, Gao feng wrote:
> > On 06/11/2013 05:24 AM, Serge E. Hallyn wrote:
> > > Quoting Gao feng (gaofeng@cn.fujitsu.com):
> > >> On 06/07/2013 06:47 AM, Serge Hallyn wrote:
> > >>> Quoting Serge Hallyn (serge.hallyn@ubuntu.com):
> > >>>> Quoting Gao feng (gaofeng@cn.fujitsu.com):
> > >>>>> On 05/07/2013 10:20 AM, Gao feng wrote:
> 
> > In my option, the audit rules(inode, tree_list, filter) , some of audit
> > controller related resources(enabled,pid,portid...) and skb queue, audit
> > netlink sockets,kauditd thread should be per-userns. The audit user message
> > which generated by the user in container should be per-userns too.
> > 
> > Since netns is not implemented as a hierarchy, and the network related
> > resources are not global. so network related audit message should be per-userns too.
> > 
> > The security related audit message should be send to init user namespace
> > as we discussed before. Maybe tty related audit message should be send
> > to init user namespace too, I have no idea now.
> > 
> > The next step, I will post a new patchset which only make the audit user
> > message and the basic audit resource per userns. I think this patchset
> > will easy to be reviewed and accepted, And will not influence the host.
> > This patchset contains the below patches:
> 
> I think this would be easier for us do from a certification and
> doumentation PoV if we had an audit namespace, not tied to the user
> namespace.  creating a new audit namespace should require
> CAP_AUDIT_CONTROL in the user namespace which created the current audit
> namespace.
> 
> Does that make sense?  I don't mind messages staying completely inside
> the current namespace, but that means we can't give unpriv users (even
> if they have priv in their user namespace) a new audit namespace...

I think that makes sense.

One of the goals for user namespace is to ensure that unprivileged users
can play with their environment without the risk of setuid-root apps on
the host being tricked by the new environment.  This makes tying the
audit ns to the user ns trickier.

-serge
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/