What fields should be used for reporting shared memory?

[Martin Kletzander]

On Thu, Mar 16, 2017 at 09:04:52PM -0400, Steve Grubb wrote:
>Hello,
>
>I apologize for the delay.
>
>On Tuesday, March 14, 2017 7:42:27 AM EDT Martin Kletzander wrote:
>> I am going through the fields in the dictionary and I can't find any
>> name to use for the following scenario.
>>
>> We (libvirt) are running virtual machines and there's a thing nowadays,
>> that people like to use, called ivshmem (Inter-VM SHared MEMory).  From
>> host's point of view this is just a shared memory region accessed by
>> multiple VMs (and possibly to host as well).  The machine maps the
>> shared memory given a name (e.g. name "asdf" results in /dev/shm/asdf to
>> be mapped) *or* it can communicate with a server over UNIX socket and
>> that server handles interrupts and also tells the client which shared
>> memory region to map.
>
>If both of these result in a path, then I think we want to log it as a
>resource event.
>

Yes, and they both are resources in its sense. So you are talking
particularly about the resrc= field?  Should that also have category and
class or anything else set?  Or do you mean we report the path in the
resrc= field?

>> Talking about information we have; in server-less
>> setup it's the shared memory region that is shared, in the server
>> scenario it is the socket.  That's information we can output.
>
>Above you mentioned that the server communicates which region to map. Can you
>explain what that means?
>

The server sends a file descriptor to the VM over the socket, details
can be found here:

http://git.qemu-project.org/?p=qemu.git;a=blob;f=docs/specs/ivshmem-spec.txt#l151

>> So my question is, when starting a domain or hot-(un)plugging, what
>> naming should we use for this kind of device and what are the things
>> that we should describe about it?  Basically, how would you like the
>> message to look?
>
>We need a record recording what is getting assigned to the VM. In the case of
>the /dev/shm, you can record that as a path which must be escaped. In the case
>of the server, I think we still need to understand what is happening. Just
>recording a socket number or path is not terribly useful in reconstructing the
>resources given to the VM.
>
>Audit events have to tell a story. There is a subect, object, action, and
>results. It kind of needs to be a sentence. "libvirtd successfully assigned
>____ to vm-name."
>
>-Steve
>
>> Thanks in advance for any info.
>>
>> Have a nice day,
>> Martin
>
>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: Digital signature
URL: <http://listman.redhat.com/archives/linux-audit/attachments/20170320/8dc0df32/attachment.sig>