RFE: add namespace IDs to audit records

pcmoore commented 7 years ago

The lack of namespace identifiers in audit records can make interpreting audit records difficult in some configurations. Pay special attention to the fact that this issue is about namespace identifiers and not container identifiers; while this work will help track activities associated with containers, ultimately it is the container engine which will need to create/assign/manage the container identifier.

pcmoore commented 7 years ago

The last upstream patchset from April 2015:

https://www.redhat.com/archives/linux-audit/2015-April/msg00014.html

rgbriggs commented 7 years ago

This issue should be about making a decision between implementing a set of namespace IDs to report in audit records, or a container ID to report in audit records. Implementing namespace IDs to report in each record will consume audit record bandwidth and is likely to be more useful as an auxiliary record in the case of a syscall to avoid making existing records longer and to make them easier to ignore should that information not interest log reviewers. The last patch was v7 (not v6 as quoted above) that used the ns inode and incorporated the change from proc to nsfs.

The alternative is to develop a new container ID settable by a container manager process with a new capability (CAP_CONTAINERID_SET?) that would be stored in the task_struct, inheritable by the task's children.

References: https://bugzilla.redhat.com/show_bug.cgi?id=1045666 Aristeu Rozanski first proposed an RFC of a set of namespace IDs 2013-03-18: https://www.redhat.com/archives/linux-audit/2013-March/msg00020.html (thread cont'd: https://www.redhat.com/archives/linux-audit/2013-March/msg00033.html https://www.redhat.com/archives/linux-audit/2014-January/msg00180.html) RGB: V1: https://www.redhat.com/archives/linux-audit/2013-July/msg00027.html omoris: https://www.redhat.com/archives/linux-audit/2013-December/msg00011.html v?: https://www.redhat.com/archives/linux-audit/2013-December/msg00112.html

Bill Roberts interest v?: https://www.redhat.com/archives/linux-audit/2014-April/msg00097.html v2: https://www.redhat.com/archives/linux-audit/2014-May/msg00049.html v3: https://www.redhat.com/archives/linux-audit/2014-May/msg00071.html v4: https://www.redhat.com/archives/linux-audit/2014-August/msg00036.html
Nicholas Dichtel https://www.redhat.com/archives/linux-audit/2014-August/msg00035.html v5: https://www.redhat.com/archives/linux-audit/2014-October/msg00030.html v6: https://www.redhat.com/archives/linux-audit/2015-April/msg00014.html v7: https://www.redhat.com/archives/linux-audit/2015-May/msg00018.html Scott Guland: https://www.redhat.com/archives/linux-audit/2015-November/msg00006.html LSS 2016 presentation: http://tricolour.ca/slides/lss-2016-audit-namespaces.pdf
https://www.youtube.com/watch?v=iYbZGoTNQ4A Aravinda Prasad: https://lkml.org/lkml/2017/1/11/209
https://lwn.net/Articles/699819/#Comments (thread start: https://lkml.org/lkml/2016/12/15/530)

tiran commented 7 years ago

I attended to @pcmoore's talk about namespaces and auditing at DevConf.CZ. A unique container id would solve several a problem we are facing in Custodia (https://github.com/latchset/custodia). Custodia is a technology for end-to-end key management, or simply speaking an API to request secrets from a service. For containers we use Unix sockets for both transport and authentication. Right now we are required to use horrible hacks to map a PID (SO_PEERSEC and SO_PEERCRED) to a container id (regexp on /proc/PID/cgroup), https://speakerdeck.com/tiran/pycon-2016-file-descriptors-unix-sockets-and-other-posix-magic?slide=53

A proper namespace identifier and something like getsockopt(SOL_SOCKET, SO_CONTAINERID) would make our approach both simpler and more secure.

rgbriggs commented 7 years ago

Thanks @tiran, I did happen to see your tech-talk last week, so I have an idea of which you speak, but will need to go back and have a closer look to understand the details. Thanks for the feedback.

tiran commented 7 years ago

thanks @rgbriggs I'm in Brno until the end of the week. Let's talk next week.

rgbriggs commented 7 years ago

@tiran If you can find a few moments to chat with @pcmoore while he is still there that might also be helpful.

tiran commented 7 years ago

@npmccallum suggested to add a syscall to retrieve a container id by syscall. The approach has some potential benefits and drawbacks. it's more general usable but requires the service to run in the same PID namespace or host PID namespace.

rgbriggs commented 7 years ago

Here's a patchset from David Howells that makes an attempt at a kernel container object that would be useful for our use case: https://lkml.org/lkml/2017/5/22/645 The LWN article reviewing it: https://lwn.net/Articles/723561/

rgbriggs commented 7 years ago

Posted Kernel Audit Container ID proposal upstream: https://www.redhat.com/archives/linux-audit/2017-September/msg00082.html https://lkml.org/lkml/2017/9/13/383