lkml.org 
[lkml]   [2018]   [May]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [RFC PATCH ghak32 V2 01/13] audit: add container id
    On Thu, 17 May 2018 17:56:00 -0400
    Richard Guy Briggs <rgb@redhat.com> wrote:

    > > During syscall events, the path info is returned in a a record
    > > simply called AUDIT_PATH, cwd info is returned in AUDIT_CWD. So,
    > > rather than calling the record that gets attached to everything
    > > AUDIT_CONTAINER_INFO, how about simply AUDIT_CONTAINER.
    >
    > Considering the container initiation record is different than the
    > record to document the container involved in an otherwise normal
    > syscall, we need two names. I don't have a strong opinion what they
    > are.
    >
    > I'd prefer AUDIT_CONTAIN and AUDIT_CONTAINER_INFO so that the two
    > are different enough to be visually distinct while leaving
    > AUDIT_CONTAINERID for the field type in patch 4 ("audit: add
    > containerid filtering")

    How about AUDIT_CONTAINER for the auxiliary record? The one that starts
    the container, I don't have a strong opinion on. Could be
    AUDIT_CONTAINER_INIT, AUDIT_CONTAINER_START, AUDIT_CONTAINERID,
    AUDIT_CONTAINER_ID, or something else. The API call that sets the ID
    for filtering could be AUDIT_CID or AUDIT_CONTID if that helps decide
    what the initial event might be. Normally, it should match the field
    being filtered.

    Best Regards,
    -Steve

    \
     
     \ /
      Last update: 2018-05-18 15:58    [W:4.121 / U:0.216 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site