Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753526AbbDQHhK (ORCPT ); Fri, 17 Apr 2015 03:37:10 -0400 Received: from mx1.redhat.com ([209.132.183.28]:52458 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753360AbbDQHg4 (ORCPT ); Fri, 17 Apr 2015 03:36:56 -0400 From: Richard Guy Briggs To: containers@lists.linux-foundation.org, linux-kernel@vger.kernel.org, linux-audit@redhat.com Cc: Richard Guy Briggs , sgrubb@redhat.com, eparis@parisplace.org, pmoore@redhat.com, arozansk@redhat.com, ebiederm@xmission.com, serge@hallyn.com, zohar@linux.vnet.ibm.com Subject: [PATCH V6 08/10] fork: audit on creation of new namespace(s) Date: Fri, 17 Apr 2015 03:35:55 -0400 Message-Id: <1b4723533470b0acdc5ff663093ad13de3baf46d.1429252659.git.rgb@redhat.com> In-Reply-To: References: In-Reply-To: References: Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1231 Lines: 43 When clone(2) is called to fork a new process creating one or more namespaces, audit the event to tie the new pid with the namespace IDs. Signed-off-by: Richard Guy Briggs --- kernel/fork.c | 3 +++ kernel/nsproxy.c | 1 + 2 files changed, 4 insertions(+), 0 deletions(-) diff --git a/kernel/fork.c b/kernel/fork.c index 6a13c46..2ea1225 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -1624,6 +1624,9 @@ long do_fork(unsigned long clone_flags, get_task_struct(p); } + if (unlikely(clone_flags & CLONE_NEW_MASK_ALL)) + audit_log_ns_info(p); + wake_up_new_task(p); /* forking complete and child started to run, tell ptracer */ diff --git a/kernel/nsproxy.c b/kernel/nsproxy.c index 8e78110..d5353c2 100644 --- a/kernel/nsproxy.c +++ b/kernel/nsproxy.c @@ -25,6 +25,7 @@ #include #include #include +#include static struct kmem_cache *nsproxy_cachep; -- 1.7.1 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/