Received: by 10.192.165.148 with SMTP id m20csp693105imm; Fri, 20 Apr 2018 13:52:11 -0700 (PDT) X-Google-Smtp-Source: AIpwx4+n2GEtkPxdUFn2ryX2ECTMVdu/yYwLf+dyoIAqfc9qZ+2T147AAI1QpHmuwfRMpPThFeYs X-Received: by 2002:a17:902:595e:: with SMTP id e30-v6mr11456558plj.233.1524257531115; Fri, 20 Apr 2018 13:52:11 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1524257531; cv=none; d=google.com; s=arc-20160816; b=fjNkV/GtBC3USLjxmZZz+f98RXwey6nAhg0wI6ywF4Y7Y7skgoBuD+ymKC0ovkFN3h 8hr9e2KXibyXC50nq4bo47aCCw8uu5bKdCLFgpjxhwgOfeM/+ugl8D0j0T4GQ0vKG8bW 1A25g4uUr3xjRU1rZ8lGoNfSrg5O/nLLOEAY/oVMmW9orxoFcFoQ9z9vl7F/ZkgG5k35 MCsijxjhTpdFeO5WBj1XQMvs/WAWNhwvWD/PqdIHjTujhudgUmJHMKeTnrnVIhb/fl4t vgpbt6e55LS76EsOSft/gXESSF0KlJDE3WGG+EpHXy0TKaWp6fo/bFnmXt2chkwwmyVi JX/A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:user-agent:in-reply-to :content-disposition:mime-version:references:message-id:subject:cc :to:from:date:arc-authentication-results; bh=g2T+bTvPKZ5XUoHEv4mzdMjeKqdkbBsDW4nAtNV7BLg=; b=jxrPS6Vm6DPYFOfsIr7RnDPwOx1THSTWES7oVBT/SWk64r12iyqnL8fjV50MBW5Zzs MtN2xwGC72X9ya5CSDnofV09P5W3P2XkAw1NrLfK33plMdSTdggGFrh5JoUr7pGxZWX5 ihtXFuaa80QeeCZu8pFlaBVsq+K3d0J/4dRn0PvBXIrec1FxJ3oa6WlXmPPfYZX+obNq AuR6pjhBMHjsXprrA35UaX4x0x+CCs7r8vGgR1x+vPh6vd0fQA9SeKAMC8SqC4v91OeO +hp79Q9NimTMzAVrWdhVG3cvThmErAgfq/nxgcpIBDgbqi71JB+t2jqGDq+naS1MHvCo OSeA== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=redhat.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id n74si6044643pfk.51.2018.04.20.13.51.34; Fri, 20 Apr 2018 13:52:11 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=redhat.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752775AbeDTUsg (ORCPT + 99 others); Fri, 20 Apr 2018 16:48:36 -0400 Received: from mx3-rdu2.redhat.com ([66.187.233.73]:60510 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1752683AbeDTUse (ORCPT ); Fri, 20 Apr 2018 16:48:34 -0400 Received: from smtp.corp.redhat.com (int-mx05.intmail.prod.int.rdu2.redhat.com [10.11.54.5]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id E6EC481A88B4; Fri, 20 Apr 2018 20:48:33 +0000 (UTC) Received: from madcap2.tricolour.ca (ovpn-112-12.rdu2.redhat.com [10.10.112.12]) by smtp.corp.redhat.com (Postfix) with ESMTPS id BEBFEAFD79; Fri, 20 Apr 2018 20:48:22 +0000 (UTC) Date: Fri, 20 Apr 2018 16:42:25 -0400 From: Richard Guy Briggs To: Paul Moore Cc: simo@redhat.com, jlayton@redhat.com, carlos@redhat.com, linux-api@vger.kernel.org, containers@lists.linux-foundation.org, LKML , Eric Paris , dhowells@redhat.com, Linux-Audit Mailing List , ebiederm@xmission.com, luto@kernel.org, netdev@vger.kernel.org, linux-fsdevel@vger.kernel.org, cgroups@vger.kernel.org, serge@hallyn.com, viro@zeniv.linux.org.uk Subject: Re: [RFC PATCH ghak32 V2 11/13] audit: add support for containerid to network namespaces Message-ID: <20180420204225.iik2lgtj6gx2ep4w@madcap2.tricolour.ca> References: <11b43a498e768a14764594c808a96b34d52be0af.1521179281.git.rgb@redhat.com> <20180420200226.7tyxzuovdbgclw3m@madcap2.tricolour.ca> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: NeoMutt/20171027 X-Scanned-By: MIMEDefang 2.79 on 10.11.54.5 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.11.55.8]); Fri, 20 Apr 2018 20:48:34 +0000 (UTC) X-Greylist: inspected by milter-greylist-4.5.16 (mx1.redhat.com [10.11.55.8]); Fri, 20 Apr 2018 20:48:34 +0000 (UTC) for IP:'10.11.54.5' DOMAIN:'int-mx05.intmail.prod.int.rdu2.redhat.com' HELO:'smtp.corp.redhat.com' FROM:'rgb@redhat.com' RCPT:'' Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 2018-04-20 16:22, Paul Moore wrote: > On Fri, Apr 20, 2018 at 4:02 PM, Richard Guy Briggs wrote: > > On 2018-04-18 21:46, Paul Moore wrote: > >> On Fri, Mar 16, 2018 at 5:00 AM, Richard Guy Briggs wrote: > >> > Audit events could happen in a network namespace outside of a task > >> > context due to packets received from the net that trigger an auditing > >> > rule prior to being associated with a running task. The network > >> > namespace could in use by multiple containers by association to the > >> > tasks in that network namespace. We still want a way to attribute > >> > these events to any potential containers. Keep a list per network > >> > namespace to track these container identifiiers. > >> > > >> > Add/increment the container identifier on: > >> > - initial setting of the container id via /proc > >> > - clone/fork call that inherits a container identifier > >> > - unshare call that inherits a container identifier > >> > - setns call that inherits a container identifier > >> > Delete/decrement the container identifier on: > >> > - an inherited container id dropped when child set > >> > - process exit > >> > - unshare call that drops a net namespace > >> > - setns call that drops a net namespace > >> > > >> > See: https://github.com/linux-audit/audit-kernel/issues/32 > >> > See: https://github.com/linux-audit/audit-testsuite/issues/64 > >> > Signed-off-by: Richard Guy Briggs > >> > --- > >> > include/linux/audit.h | 7 +++++++ > >> > include/net/net_namespace.h | 12 ++++++++++++ > >> > kernel/auditsc.c | 9 ++++++--- > >> > kernel/nsproxy.c | 6 ++++++ > >> > net/core/net_namespace.c | 45 +++++++++++++++++++++++++++++++++++++++++++++ > >> > 5 files changed, 76 insertions(+), 3 deletions(-) > > ... > > >> > diff --git a/kernel/nsproxy.c b/kernel/nsproxy.c > >> > index f6c5d33..d9f1090 100644 > >> > --- a/kernel/nsproxy.c > >> > +++ b/kernel/nsproxy.c > >> > @@ -140,6 +140,7 @@ int copy_namespaces(unsigned long flags, struct task_struct *tsk) > >> > struct nsproxy *old_ns = tsk->nsproxy; > >> > struct user_namespace *user_ns = task_cred_xxx(tsk, user_ns); > >> > struct nsproxy *new_ns; > >> > + u64 containerid = audit_get_containerid(tsk); > >> > > >> > if (likely(!(flags & (CLONE_NEWNS | CLONE_NEWUTS | CLONE_NEWIPC | > >> > CLONE_NEWPID | CLONE_NEWNET | > >> > @@ -167,6 +168,7 @@ int copy_namespaces(unsigned long flags, struct task_struct *tsk) > >> > return PTR_ERR(new_ns); > >> > > >> > tsk->nsproxy = new_ns; > >> > + net_add_audit_containerid(new_ns->net_ns, containerid); > >> > return 0; > >> > } > >> > >> Hopefully we can handle this in audit_net_init(), we just need to > >> figure out where we can get the correct task_struct for the audit > >> container ID (some backpointer in the net struct?). > > > > I don't follow. This needs to happen on every task startup. > > audit_net_init() is only called when a new network namespace starts up. > > Yep, sorry, my mistake. I must have confused myself when I was > looking at the code. > > I'm thinking out loud here, bear with me ... > > Assuming we move the netns/audit-container-ID tracking to audit_net, > and considering we already have an audit hook in copy_process() (it > calls audit_alloc()), would this be better handled by the > copy_process() hook? This ignores naming, audit_alloc() reuse, etc.; > those can be easily fixed. I'm just thinking of ways to limit our > impact on the core kernel and leverage our existing interaction > points. The new namespace hasn't been cloned yet and this is the only function where we have access to both namespaces, so I don't see how that could work... > paul moore - RGB -- Richard Guy Briggs Sr. S/W Engineer, Kernel Security, Base Operating Systems Remote, Ottawa, Red Hat Canada IRC: rgb, SunRaycer Voice: +1.647.777.2635, Internal: (81) 32635