On 2018-10-19 19:16, Paul Moore wrote: > On Tue, Jul 31, 2018 at 4:11 PM Richard Guy Briggs <[email protected]> wrote: > > Add audit container identifier support to ptrace and signals. In > > particular, the "op" field provides a way to label the auxiliary record > > to which it is associated. > > > > Signed-off-by: Richard Guy Briggs <[email protected]> > > Acked-by: Serge Hallyn <[email protected]> > > --- > > include/linux/audit.h | 11 +++++------ > > kernel/audit.c | 13 +++++++------ > > kernel/audit.h | 2 ++ > > kernel/auditsc.c | 21 ++++++++++++++++----- > > 4 files changed, 30 insertions(+), 17 deletions(-) > > ... > > > @@ -155,9 +156,8 @@ extern void audit_log_key(struct > > audit_buffer *ab, > > extern int audit_log_task_context(struct audit_buffer *ab); > > extern void audit_log_task_info(struct audit_buffer *ab, > > struct task_struct *tsk); > > -extern int audit_log_contid(struct task_struct *tsk, > > - struct audit_context *context, > > - char *op); > > +extern int audit_log_contid(struct audit_context *context, > > + char *op, u64 contid); > > > > extern int audit_update_lsm_rules(void); > > ... > > > @@ -2047,23 +2049,22 @@ void audit_log_session_info(struct audit_buffer *ab) > > > > /* > > * audit_log_contid - report container info > > - * @tsk: task to be recorded > > * @context: task or local context for record > > * @op: contid string description > > + * @contid: container ID to report > > */ > > -int audit_log_contid(struct task_struct *tsk, > > - struct audit_context *context, char *op) > > +int audit_log_contid(struct audit_context *context, > > + char *op, u64 contid) > > { > > struct audit_buffer *ab; > > > > - if (!audit_contid_set(tsk)) > > + if (!audit_contid_valid(contid)) > > return 0; > > /* Generate AUDIT_CONTAINER record with container ID */ > > ab = audit_log_start(context, GFP_KERNEL, AUDIT_CONTAINER); > > if (!ab) > > return -ENOMEM; > > - audit_log_format(ab, "op=%s contid=%llu", > > - op, audit_get_contid(tsk)); > > + audit_log_format(ab, "op=%s contid=%llu", op, contid); > > audit_log_end(ab); > > return 0; > > } > > My previous comments still apply: these audit_log_contid() changes > should be done earlier in the patchset when you first define > audit_log_contid().
No worries, missed that. > paul moore - RGB -- Richard Guy Briggs <[email protected]> Sr. S/W Engineer, Kernel Security, Base Operating Systems Remote, Ottawa, Red Hat Canada IRC: rgb, SunRaycer Voice: +1.647.777.2635, Internal: (81) 32635 -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
