search

projectatomic / docker

Docker - the open-source application container engine
http://www.docker.com
Apache License 2.0
81 stars 58 forks source link

Initialize Audit loggings cli.daemon #292

Closed TomSweeneyRedHat closed 6 years ago

TomSweeneyRedHat commented 6 years ago

Signed-off-by: TomSweeneyRedHat tsweeney@redhat.com

Audit logging was not showing the containers id or other information as it should about the container. The issue was the cli.d field in the dockerd/daemon.code was being passed down to the cli.initMiddlewares() function before the cli.d field was initialized with the information for the docker daemon. The cli.initMiddlewares() function initialized the Audit Logging and since it had a nil pointer for the daemon, it was never able to resolve the containers information and the default "?" was always shown instead.

This addresses https://bugzilla.redhat.com/show_bug.cgi?id=1496176

- What I did I've added a 'ctr_id_short' field to the audit logging and a couple of debug messages. The fix itself was to move the initialization of the cli.d field above the call to cli.initMiddlewares() within the dockerd/daemon code.

- How I did it Changed the code and lots of testing.

- How to verify it

The old audit log entries looked like:

type=VIRT_CONTROL msg=audit(1512770060.628:254): pid=1768 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:container_runtime_t:s0 msg='op=attach vm-pid=? auid=0 hostname=? reason=api vm=? user=root exe=?  exe="/usr/bin/dockerd-current" hostname=? addr=? terminal=? res=success'

The new ones look like:

type=VIRT_CONTROL msg=audit(1515610710.130:485): pid=19793 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:container_runtime_t:s0 msg='reason=api auid=0 exe=sleep hostname=8386cb7735f4 ctr_id_short=8386cb7735f4 op=attach vm=centos vm-pid=0 user=root  exe="/usr/bin/dockerd-current" hostname=? addr=? terminal=? res=success'

Note the addition of the ctr_id_short field and the appropriate values in the vm, vm-pid, exed and other fields.

- Description for the changelog Correct audit logging for container operations.

TomSweeneyRedHat commented 6 years ago

@rhatdan , @runcom @jwhonce PTAL. Will update over Docker versions after this is approved/merged.

rhatdan commented 6 years ago

@TomSweeneyRedHat I believe we need the same PR for docker-1.13. Which is soon to be the default and only docker.

TomSweeneyRedHat commented 6 years ago

@rhatdan ack other versions. Will spin something up tomorrow. Got distracted with Buildah RHEL doc review today.