[Part1 PATCH 00/22] Add namespace support for audit

[Eric W. Biederman]

Gao feng <gaofeng at cn.fujitsu.com> writes:

> On 06/20/2013 11:02 AM, Gao feng wrote:
>> If we don't tie audit to user namespace, there is still one problem.
>
> One more problem. some audit messages are generated by some net subsystem
> such as netfilter. If we don't tie audit to user namespace, we have no
> idea where these audit messages should go. there is no relationship between
> net namespace and audit namespace while we can get user namespace through
> net user namespace.

I am in favor of the user namespace tie in.

I am in favor of running a per user namespace audit filter once per user
namespace walking up the user namespace hierarchy.  Each filter would
deliver messages to a different userspace audit daemon.

Until we agreement to go that far I am not certain the kernel generated
audit messages should go anywhere except to the global audit daemon.

I think on an individual basis we can look at kernel audit messages and
see if they should go to just the global user namespace.  Just the user
namspace of the relevant network stack.  Or if the message should go to
the audit daemon of every user namespace that is an ancestor of some
starting user namespace.

But please let's error on the side of caution here.

Eric