[libvirt] [PATCH 5/7] Add auditing of start/stop events to the QEMU driver

[Daniel P. Berrange]

On Wed, Oct 27, 2010 at 04:46:30PM +0200, Daniel Veillard wrote:
> On Wed, Oct 27, 2010 at 03:39:02PM +0100, Daniel P. Berrange wrote:
> > On Wed, Oct 27, 2010 at 04:33:03PM +0200, Daniel Veillard wrote:
> > > On Wed, Oct 27, 2010 at 12:36:15PM +0100, Daniel P. Berrange wrote:
> > > > Add audit hooks to report all start and stop events on QEMU
> > > > guest domains.
> > > > 
> > > > * src/qemu/qemu_driver.c: Audit start/stop events
> > > > ---
> > > >  src/qemu/qemu_driver.c |   59 ++++++++++++++++++++++++++++++++++++++++++++++-
> > > >  1 files changed, 57 insertions(+), 2 deletions(-)
> > > 
> > >   patch 1-4 trivial ACKs
> > > 
> > > One of the differences if we lock down in the driver (beside the
> > > redundancy that will be needed) is that we end up writing to the
> > > audit system deep in the driver with all the locks needed for operation.
> > > Is there a risk of being blocked while writing to the audit system ?
> > > This could potentially be a problem because all operations on the
> > > domain would be stopped during that time.
> > 
> > Quite possibly, but I believe audit people would describe this scenario
> > as a feature, rather than a bug :-)
> 
>   Grumpf ... :-(
> I'm fine with allowing code which can monitor/affect normal operation
> behaviour but it must be off by default then.
> There is no default set in daemon/libvirtd.conf for audit_level, I
> would like to see an assumed value of 0 then, is that the case ?

The default is that libvirt auditing will be enabled, if auditing is
enabled on the OS.

Regards,
Daniel
-- 
|: Red Hat, Engineering, London    -o-   http://people.redhat.com/berrange/ :|
|: http://libvirt.org -o- http://virt-manager.org -o- http://deltacloud.org :|
|: http://autobuild.org        -o-         http://search.cpan.org/~danberr/ :|
|: GnuPG: 7D3B9505  -o-   F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 :|