Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752160AbdLKThS (ORCPT ); Mon, 11 Dec 2017 14:37:18 -0500 Received: from mx1.redhat.com ([209.132.183.28]:35684 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750929AbdLKThN (ORCPT ); Mon, 11 Dec 2017 14:37:13 -0500 From: Steve Grubb To: linux-audit@redhat.com Cc: Eric Paris , Casey Schaufler , =?ISO-8859-1?Q?Micka=EBl_Sala=FCn?= , Richard Guy Briggs , cgroups@vger.kernel.org, Linux Containers , Linux API , Linux FS Devel , Linux Kernel , Linux Network Development Subject: Re: RFC(v2): Audit Kernel Container IDs Date: Mon, 11 Dec 2017 14:37:05 -0500 Message-ID: <1574245.bUo6J1duCc@x2> Organization: Red Hat In-Reply-To: <1513009857.6310.337.camel@redhat.com> References: <20171012141359.saqdtnodwmbz33b2@madcap2.tricolour.ca> <1513009857.6310.337.camel@redhat.com> MIME-Version: 1.0 Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.30]); Mon, 11 Dec 2017 19:37:13 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 981 Lines: 23 On Monday, December 11, 2017 11:30:57 AM EST Eric Paris wrote: > > Because a container doesn't have to use namespaces to be a container > > you still need a mechanism for a process to declare that it is in > > fact > > in a container, and to identify the container. > > I like the idea but I'm still tossing it around in my head (and > thinking about Casey's statement too). Lets say we have a 'docker-like' > container with pid=100 netns=X,userns=Y,mountns=Z. If I'm on the host > in all init namespaces and I run > nsenter -t 100 -n ip link set eth0 promisc on > How should this be logged? If it is a normal process, then everything would match the init name space and you wouldn't have entered a container. If it were a container, any generated event should have the container ID from registration attached to it. > Did this command run in it's own 'container' unrelated to the 'docker-like' > container? That should be determined by what's in the task struct. -Steve