[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: [libvirt] [PATCH] Include pid namespace inode in LXC audit messages



On 2013/03/11 20:34, Aristeu Rozanski wrote:
> On Mon, Mar 11, 2013 at 04:27:58PM +0800, Gao feng wrote:
>> On 2013/03/06 23:10, Daniel P. Berrange wrote:
>>> From: "Daniel P. Berrange" <berrange redhat com>
>>>
>>> To allow the efficient correlation of container audit messages
>>> with host hosts, include the pid namespace inode in audit
>>> messages.
>>>
>>> The resulting audit message will be
>>>
>>> type=VIRT_CONTROL msg=audit(1362582468.378:50): pid=19284 uid=0 auid=0 ses=312 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='virt=lxc op=init vm="demo" uuid=0770f019-2d4e-09e9-8e4a-719e12b3a18e vm-pid=19620 init-pid=19622 pid-ns=23434 exe="/home/berrange/src/virt/libvirt/daemon/.libs/lt-libvirtd" hostname=? addr=? terminal=pts/6 res=success'
>>>
>>> Note the 'pid-ns' field showing the inode number of the PID
>>> namespace of the container init process. Since /proc/PID/ns/pid
>>> doesn't exist on older kernels, we keep the previous 'init-pid'
>>> field too, showing the host PID of the init process.
>>>
>>
>> The inode numbers of /proc/PID/ns/pid are different even two task
>> in the same pid namespace...
>>

ignore this incorrect information,I used the lstat...

>> We can't use this inode number to identify pid namespace.
>> Or I misunderstand what's the purpose of this patch?
> 
> not in kernels 3.8 and newer
> http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=98f842e675f96ffac96e6c50315790912b2812be
> 

Thanks for your explanation.


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]