[PATCH RFC] audit: provide namespace information in user originated records

Serge Hallyn serge.hallyn at ubuntu.com
Wed Mar 20 18:36:52 UTC 2013


Quoting Aristeu Rozanski (arozansk at redhat.com):
> This is a bit fuzzy to me, perhaps due I'm not fully understanding
> userns implementation yet, so bear with me:
> I thought of changing so userns would not grant CAP_AUDIT_WRITE and
> CAP_AUDIT_CONTROL unless the process already has it (i.e. it'd require

Seems like CAP_AUDIT_WRITE should be targeted against the
skb->netns->userns.  Then CAP_AUDIT_WRITE can be treated like any other
capability.  Last I knew (long time ago) you had to be in init_user_ns
to talk audit, but that's ok - this would just do the right thing in
any case.

-serge




More information about the Linux-audit mailing list