[libvirt] [PATCH] Include pid namespace inode in LXC audit messages

Eric Blake eblake at redhat.com
Wed Mar 6 16:19:08 UTC 2013


On 03/06/2013 08:10 AM, Daniel P. Berrange wrote:
> From: "Daniel P. Berrange" <berrange at redhat.com>
> 
> To allow the efficient correlation of container audit messages
> with host hosts, include the pid namespace inode in audit
> messages.
> 
> The resulting audit message will be
> 
> type=VIRT_CONTROL msg=audit(1362582468.378:50): pid=19284 uid=0 auid=0 ses=312 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='virt=lxc op=init vm="demo" uuid=0770f019-2d4e-09e9-8e4a-719e12b3a18e vm-pid=19620 init-pid=19622 pid-ns=23434 exe="/home/berrange/src/virt/libvirt/daemon/.libs/lt-libvirtd" hostname=? addr=? terminal=pts/6 res=success'
> 
> Note the 'pid-ns' field showing the inode number of the PID
> namespace of the container init process. Since /proc/PID/ns/pid
> doesn't exist on older kernels, we keep the previous 'init-pid'
> field too, showing the host PID of the init process.
> 

> @@ -637,8 +667,20 @@ static void virLXCProcessMonitorInitNotify(virLXCMonitorPtr mon ATTRIBUTE_UNUSED
>                                             virDomainObjPtr vm)
>  {
>      virLXCDomainObjPrivatePtr priv = vm->privateData;
> +    ino_t inode;
> +
>      priv->initpid = initpid;
> -    virDomainAuditInit(vm, initpid);
> +
> +    if (virLXCProcessGetNsInode(initpid, "pid", &inode) < 0) {
> +        virErrorPtr err = virGetLastError();
> +        VIR_WARN("Cannot obtain pid NS inode for %llu: %s",
> +                 (unsigned long long)initpid,
> +                 err && err->message ? err->message : "<unknown>");
> +        virResetLastError();

So if we fail because the kernel is too old, inode is left uninitialized...

> +    } else {
> +        inode = 0;

...and if we succeed on a new kernel, we wipe out the kernel's answer
with a forced 0.  Oops.

Drop the one line '} else {', and the logic will be fixed.

ACK with that change.

-- 
Eric Blake   eblake redhat com    +1-919-301-3266
Libvirt virtualization library http://libvirt.org

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 621 bytes
Desc: OpenPGP digital signature
URL: <http://listman.redhat.com/archives/libvir-list/attachments/20130306/971a9206/attachment-0001.sig>


More information about the libvir-list mailing list