<html><head></head><body><div style="color:#000; background-color:#fff; font-family:Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:13px"><div id="yui_3_16_0_ym19_1_1520015455761_175848"><span id="yui_3_16_0_ym19_1_1520015455761_176473">Hello Auditd'ers,</span></div><div id="yui_3_16_0_ym19_1_1520015455761_175848"><span><br></span></div><div id="yui_3_16_0_ym19_1_1520015455761_175848"><span id="yui_3_16_0_ym19_1_1520015455761_175995">I am running a privileged container with pid, net, uts space shared with the host. The need is to be able to set file watch rules from the container say </span></div><div id="yui_3_16_0_ym19_1_1520015455761_175848"><span><br></span></div><div id="yui_3_16_0_ym19_1_1520015455761_175848" dir="ltr"><span id="yui_3_16_0_ym19_1_1520015455761_176125">-k /etc -p rw -k containter_rule</span></div><div id="yui_3_16_0_ym19_1_1520015455761_175848" dir="ltr"><span><br></span></div><div id="yui_3_16_0_ym19_1_1520015455761_175848" dir="ltr"><span id="yui_3_16_0_ym19_1_1520015455761_176124">and then look for read/write access to files/directories in /var/log/audit/*.</span></div><div id="yui_3_16_0_ym19_1_1520015455761_175848" dir="ltr"><span><br></span></div><div id="yui_3_16_0_ym19_1_1520015455761_175848" dir="ltr"><span id="yui_3_16_0_ym19_1_1520015455761_176123">What I am finding is there are no watch events being logged</span></div><div id="yui_3_16_0_ym19_1_1520015455761_175848" dir="ltr"><span><br></span></div><div id="yui_3_16_0_ym19_1_1520015455761_175848" dir="ltr"><span id="yui_3_16_0_ym19_1_1520015455761_176088">If I set the same audit watch rule from the host (and not being in the privileged container) I am able to get audit events</span></div><div id="yui_3_16_0_ym19_1_1520015455761_175848" dir="ltr"><span id="yui_3_16_0_ym19_1_1520015455761_176446"><br id="yui_3_16_0_ym19_1_1520015455761_176445"></span></div><div id="yui_3_16_0_ym19_1_1520015455761_175848" dir="ltr"><span id="yui_3_16_0_ym19_1_1520015455761_176122">Using nsenter to switch namespace (nsenter -t 1 auditctl </span>-k /etc -p rw -k containter_rule) does not help either</div><div id="yui_3_16_0_ym19_1_1520015455761_175848" dir="ltr"><br></div><div id="yui_3_16_0_ym19_1_1520015455761_175848" dir="ltr">I suspect the mnt namespace is different which is causing this oddity in behavior</div><div id="yui_3_16_0_ym19_1_1520015455761_175848" dir="ltr"><br></div><div id="yui_3_16_0_ym19_1_1520015455761_175848" dir="ltr">looking at container process namespace -</div><div id="yui_3_16_0_ym19_1_1520015455761_175848" dir="ltr"><br></div><div dir="ltr" id="yui_3_16_0_ym19_1_1520015455761_176219">test@ubuntu-16:~/audit$ sudo ls -latr /proc/26050/ns</div><div dir="ltr" id="yui_3_16_0_ym19_1_1520015455761_176220">[sudo] password for test:</div><div dir="ltr" id="yui_3_16_0_ym19_1_1520015455761_176221">total 0</div><div dir="ltr" id="yui_3_16_0_ym19_1_1520015455761_176222">dr-xr-xr-x 9 root root 0 Mar 2 16:58 ..</div><div dir="ltr" id="yui_3_16_0_ym19_1_1520015455761_176223">dr-x--x--x 2 root root 0 Mar 2 17:46 .</div><div dir="ltr" id="yui_3_16_0_ym19_1_1520015455761_176224">lrwxrwxrwx 1 root root 0 Mar 2 17:46 uts -> uts:[4026531838]</div><div dir="ltr" id="yui_3_16_0_ym19_1_1520015455761_176225">lrwxrwxrwx 1 root root 0 Mar 2 17:46 user -> user:[4026531837]</div><div dir="ltr" id="yui_3_16_0_ym19_1_1520015455761_176226">lrwxrwxrwx 1 root root 0 Mar 2 17:46 pid -> pid:[4026531836]</div><div dir="ltr" id="yui_3_16_0_ym19_1_1520015455761_176227">lrwxrwxrwx 1 root root 0 Mar 2 17:46 net -> net:[4026531957]</div><div dir="ltr" id="yui_3_16_0_ym19_1_1520015455761_176228">lrwxrwxrwx 1 root root 0 Mar 2 17:46 mnt -> mnt:[4026532517]</div><div dir="ltr" id="yui_3_16_0_ym19_1_1520015455761_176229">lrwxrwxrwx 1 root root 0 Mar 2 17:46 ipc -> ipc:[4026532518]</div><div dir="ltr" id="yui_3_16_0_ym19_1_1520015455761_176230">lrwxrwxrwx 1 root root 0 Mar 2 17:46 cgroup -> cgroup:[4026531835]</div><div dir="ltr" id="yui_3_16_0_ym19_1_1520015455761_176231"><br></div><div dir="ltr" id="yui_3_16_0_ym19_1_1520015455761_176231">looking at init process namespace -<br></div><div dir="ltr" id="yui_3_16_0_ym19_1_1520015455761_176231"><br></div><div dir="ltr" id="yui_3_16_0_ym19_1_1520015455761_176231">test@ubuntu-16:~/audit$ sudo ls -latr /proc/1/ns</div><div dir="ltr" id="yui_3_16_0_ym19_1_1520015455761_176232">total 0</div><div dir="ltr" id="yui_3_16_0_ym19_1_1520015455761_176233">dr-xr-xr-x 9 root root 0 Mar 2 10:37 ..</div><div dir="ltr" id="yui_3_16_0_ym19_1_1520015455761_176234">lrwxrwxrwx 1 root root 0 Mar 2 10:38 mnt -> mnt:[4026531840]</div><div dir="ltr" id="yui_3_16_0_ym19_1_1520015455761_176235">dr-x--x--x 2 root root 0 Mar 2 10:38 .</div><div dir="ltr" id="yui_3_16_0_ym19_1_1520015455761_176236">lrwxrwxrwx 1 root root 0 Mar 2 16:47 uts -> uts:[4026531838]</div><div dir="ltr" id="yui_3_16_0_ym19_1_1520015455761_176237">lrwxrwxrwx 1 root root 0 Mar 2 16:47 user -> user:[4026531837]</div><div dir="ltr" id="yui_3_16_0_ym19_1_1520015455761_176238">lrwxrwxrwx 1 root root 0 Mar 2 16:47 pid -> pid:[4026531836]</div><div dir="ltr" id="yui_3_16_0_ym19_1_1520015455761_176239">lrwxrwxrwx 1 root root 0 Mar 2 16:47 net -> net:[4026531957]</div><div dir="ltr" id="yui_3_16_0_ym19_1_1520015455761_176240">lrwxrwxrwx 1 root root 0 Mar 2 16:47 ipc -> ipc:[4026531839]</div><div dir="ltr" id="yui_3_16_0_ym19_1_1520015455761_176241">lrwxrwxrwx 1 root root 0 Mar 2 16:47 cgroup -> cgroup:[4026531835]</div><div id="yui_3_16_0_ym19_1_1520015455761_175848" dir="ltr"><br></div><div id="yui_3_16_0_ym19_1_1520015455761_175848" dir="ltr"><span id="yui_3_16_0_ym19_1_1520015455761_176103">Can someone suggest on how to make this work.</span></div><div id="yui_3_16_0_ym19_1_1520015455761_175848" dir="ltr"><br></div><div class="signature" id="yui_3_16_0_ym19_1_1520015455761_176076"><div id="yiv1381234704yui_3_2_0_188_132639829305340"><span></span></div><div id="yiv1381234704yui_3_2_0_188_132639829305397">Thanks,</div><div id="yiv1381234704yui_3_2_0_188_132639829305388">Rakesh</div></div></div></body></html>