[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: [RFC][PATCH] (#2) Prelim in-kernel file system auditing support



David,

Can you ellaborate on why you think namespaces are an issue?  I'm
having a hard time understanding why this would be any more of a
problem then any other intentional subversion of the audit subsystem
by the administrator (where administrator == root).  Perhaps there is
a way for a user process to subvert the audit subsystem using
namespace trickory?

If the root user issues a "watch /etc/passwd" it will resolve to the
inode for passwd in the given namespace.  Any accesses on that inode,
in that namespace (presumably the only access we care about), by an
audited syscall will be noted and sent to userspace.  Isn't that
sufficient?

On Tue, 25 Jan 2005 20:34:04 +0000, David Woodhouse <dwmw2 infradead org> wrote:
> On Tue, 2005-01-25 at 12:29 -0600, Timothy R. Chavez wrote:
> > To be honest, I haven't really considered the chroot environment.  I
> > guess the check really needs to be after the lookup and I should
> > check:
> 
> It's not just chroot. Remember that every task in the system can in
> theory have an entirely different namespace, with different file systems
> mounted at different places.
> 
> --
> dwmw2
> 
> 


-- 
- Timothy R. Chavez


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]