[lkml]   [2013]   [Jun]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [PATCH RFC 00/48] Add namespace support for audit
Quoting Gao feng (
> On 05/07/2013 10:20 AM, Gao feng wrote:
> > This patchset try to add namespace support for audit.
> >
> > I choose to assign audit to the user namespace.
> > Right now,there are six kinds of namespaces, such as
> > net, mount, ipc, pid, uts and user. the first five
> > namespaces have special usage. the audit isn't suitable to
> > belong to these five namespaces, so the user namespace
> > may be the best choice.
> >
> > Through I decide to make audit related resources per user
> > namespace, but audit uses netlink to communicate between kernel
> > space and user space, and the netlink is a private resource
> > of per net namespace. So we need the capability to allow the
> > netlink sockets to communicate with each other in the same user
> > namespace even they are in different net namespace. [PATCH 2/48]
> > does this job, it adds a new function "compare" for per netlink
> > table to compare two sockets. it means the netlink protocols can
> > has its own compare fuction, For other protocols, two netlink
> > sockets are different if they belong to the different net namespace.
> > For audit protocol, two sockets can be the same even they in different
> > net namespace,we use user namespace not net namespace to make the
> > decision.
> >
> > There is one point that some people may dislike,in [PATCH 1/48],
> > the kernel side audit netlink socket is created only when we create
> > the first netns for the userns, and this userns will hold the netns
> > until we destroy this userns.
> >
> > The other patches just make the audit related resources per
> > user namespace.
> >
> > This patchset is sent as an RFC,any comments are welcome.


thanks for sending this. I think you need to ping the selinux folks
for comment though. It appears to me that, after this patchset, the
kernel with CONFIG_USER_NS=y could not be LSPP-compliant, because
the selinux-generated audit messages do not always go to init_user_ns.

Additionally, the only type of namespacing selinux wants is where it
is enforced by policy compiler and installer using typenames - i.e.
'container1.user_t' vs 'user_t'. Selinux does not want user namespaces
to affect selinux enforcement at all. (at least last I knew, several
years ago at a mini-summit, I believe this was from Stephen Smalley).

I think it's good to have userspace-generated audit messages (i.e.
auditctl -m 'hi there') sent to the same user namespace. But the
selinux messages, near as I can tell, need to all go to init_user_ns.


 \ /
  Last update: 2013-06-07 00:21    [W:0.286 / U:0.384 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site