[PATCH] audit: don't attempt to lookup PIDs when changing PID filtering audit rules
Paul Moore
pmoore at redhat.com
Mon Dec 15 19:03:05 UTC 2014
On Monday, December 15, 2014 12:29:52 PM Eric Paris wrote:
> Lets say I and in the non-init pid namespace.
>
> I run audictl -a exit,always -S all -F pid=1
>
> Is the audit system going to show records for what I think is pid=1 or
> what the initial pid namespace thinks is pid=1 ?
The initial namespace. If we want the executing task's current namespace we
should probably change audit_filter_user_rules().
> Which is correct? (hint, it's impossible to know pids above my
> namespace, or even to know what pid the process in question thinks it
> is, since it could be below my namespace)
Heh. I'm sorry, I tend to laugh when I hear the term "correct" during an
audit discussion ;)
Steve, Richard, Eric - what do you guys want: initial or current namespace?
> I won't pretend this is easy to solve.
>
> Steve et al. What do you think of maybe having pid= rules automatically
> removed when the pid goes away? I can't think of another way to handle
> this (although the perf hit might be so stupidly high....)
I'm personally not super excited about rules disappearing automatically and I
also believe that it should be possible to remove a rule regardless (not being
able to remove a PID filtering rule due to the status of the associated task
is silly).
--
paul moore
security and virtualization @ redhat
More information about the Linux-audit
mailing list