Re: [PATCH ghak90 V9 05/13] audit: log container info of syscalls

2020-10-28 Thread Paul Moore
On Fri, Oct 23, 2020 at 4:40 PM Richard Guy Briggs wrote: > On 2020-10-22 21:21, Paul Moore wrote: > > On Wed, Oct 21, 2020 at 12:39 PM Richard Guy Briggs wrote: > > > Here is an exmple I was able to generate after updating the testsuite > > > script to include a signalling example of a nested

Re: [PATCH ghak90 V9 05/13] audit: log container info of syscalls

2020-10-23 Thread Richard Guy Briggs
On 2020-10-22 21:21, Paul Moore wrote: > On Wed, Oct 21, 2020 at 12:39 PM Richard Guy Briggs wrote: > > Here is an exmple I was able to generate after updating the testsuite > > script to include a signalling example of a nested audit container > > identifier: > > > > > > type=PROCTITLE

Re: [PATCH ghak90 V9 05/13] audit: log container info of syscalls

2020-10-22 Thread Paul Moore
On Wed, Oct 21, 2020 at 12:39 PM Richard Guy Briggs wrote: > Here is an exmple I was able to generate after updating the testsuite > script to include a signalling example of a nested audit container > identifier: > > > type=PROCTITLE msg=audit(2020-10-21 10:31:16.655:6731) : >

Re: [PATCH ghak90 V9 05/13] audit: log container info of syscalls

2020-10-21 Thread Richard Guy Briggs
On 2020-10-21 12:49, Steve Grubb wrote: > On Wednesday, October 21, 2020 12:39:26 PM EDT Richard Guy Briggs wrote: > > > I think I have a way to generate a signal to multiple targets in one > > > syscall... The added challenge is to also give those targets different > > > audit container

Re: [PATCH ghak90 V9 05/13] audit: log container info of syscalls

2020-10-21 Thread Steve Grubb
On Wednesday, October 21, 2020 12:39:26 PM EDT Richard Guy Briggs wrote: > > I think I have a way to generate a signal to multiple targets in one > > syscall... The added challenge is to also give those targets different > > audit container identifiers. > > Here is an exmple I was able to

Re: [PATCH ghak90 V9 05/13] audit: log container info of syscalls

2020-10-21 Thread Richard Guy Briggs
On 2020-10-02 15:52, Richard Guy Briggs wrote: > On 2020-08-21 15:15, Paul Moore wrote: > > On Wed, Jul 29, 2020 at 3:41 PM Richard Guy Briggs wrote: > > > On 2020-07-05 11:10, Paul Moore wrote: > > > > On Sat, Jun 27, 2020 at 9:22 AM Richard Guy Briggs > > > > wrote: > > > > ... > > > > > >

Re: [PATCH ghak90 V9 05/13] audit: log container info of syscalls

2020-10-02 Thread Richard Guy Briggs
On 2020-08-21 15:15, Paul Moore wrote: > On Wed, Jul 29, 2020 at 3:41 PM Richard Guy Briggs wrote: > > On 2020-07-05 11:10, Paul Moore wrote: > > > On Sat, Jun 27, 2020 at 9:22 AM Richard Guy Briggs > > > wrote: > > ... > > > > > diff --git a/kernel/auditsc.c b/kernel/auditsc.c > > > > index

Re: [PATCH ghak90 V9 05/13] audit: log container info of syscalls

2020-08-21 Thread Paul Moore
On Wed, Jul 29, 2020 at 3:41 PM Richard Guy Briggs wrote: > On 2020-07-05 11:10, Paul Moore wrote: > > On Sat, Jun 27, 2020 at 9:22 AM Richard Guy Briggs wrote: ... > > > diff --git a/kernel/auditsc.c b/kernel/auditsc.c > > > index f03d3eb0752c..9e79645e5c0e 100644 > > > --- a/kernel/auditsc.c

Re: [PATCH ghak90 V9 05/13] audit: log container info of syscalls

2020-07-29 Thread Richard Guy Briggs
On 2020-07-05 11:10, Paul Moore wrote: > On Sat, Jun 27, 2020 at 9:22 AM Richard Guy Briggs wrote: > > > > Create a new audit record AUDIT_CONTAINER_ID to document the audit > > container identifier of a process if it is present. > > > > Called from audit_log_exit(), syscalls are covered. > > > >

Re: [PATCH ghak90 V9 05/13] audit: log container info of syscalls

2020-07-05 Thread Paul Moore
On Sat, Jun 27, 2020 at 9:22 AM Richard Guy Briggs wrote: > > Create a new audit record AUDIT_CONTAINER_ID to document the audit > container identifier of a process if it is present. > > Called from audit_log_exit(), syscalls are covered. > > Include target_cid references from ptrace and signal.

[PATCH ghak90 V9 05/13] audit: log container info of syscalls

2020-06-27 Thread Richard Guy Briggs
Create a new audit record AUDIT_CONTAINER_ID to document the audit container identifier of a process if it is present. Called from audit_log_exit(), syscalls are covered. Include target_cid references from ptrace and signal. A sample raw event: type=SYSCALL msg=audit(1519924845.499:257):