RFC: Containerized syslog for full fledged container (Phase-I, Take III).

Containerized syslog purpose is to avoid corrupting kernel syslog (/proc/kmsg) if a process running within a container (unsharing everything; net, namespace, pid, etc..) is probing /proc/kmsg.

The perfect example is container rsyslog daemon, competing with the host rsyslog daemon, none of the process are able to catch clean syslog messages.

Container /proc/kmsg could have been linked/redirected to /dev/null but container sys-admin could need to receive important kernel messages (SElinux, iptables logs, container own devices, etc...).

Perfect example are iptables log message where iptables rules are defined and managed within the container itself.

If HOST: and container CONT: have different sys-admin; a practical case in real production; needed iptables log messages must be directed to CONT: sys-admin while they are of none interest to HOST: sys-admin.

In broader approach, we could say all kernel messages related to CONT: device (example, a device eth0 defined within CONT:) should be directed to CONT: syslog.
Kernel will report trouble related to hardware emulation specific to container.

Containerized syslog is implemented within nsproxy and a small independent ring buffer memory is allocated to the messaging procedure named printk.

---
 include/linux/init_task.h |    2 +
 include/linux/nsproxy.h   |    2 +
 include/linux/syslog.h    |   50 ++++++++
 kernel/Makefile           |    1 +
 kernel/nsproxy.c          |   10 ++
 kernel/printk.c           |  308 +++++++++++++++++++++-----------------------
 kernel/syslog.c           |  217 +++++++++++++++++++++++++++++++
 7 files changed, 429 insertions(+), 161 deletions(-)
 create mode 100644 include/linux/syslog.h
 create mode 100644 kernel/syslog.c

index abec69b..30b479e 100644
@@ -11,6 +11,7 @@
 #include <linux/user_namespace.h>
 #include <linux/securebits.h>
 #include <net/net_namespace.h>
+#include <linux/syslog.h>
 
 extern struct files_struct init_files;
 extern struct fs_struct init_fs;

@@ -37,6 +38,7 @@ extern struct nsproxy init_nsproxy;
 	.count		= ATOMIC_INIT(1),				\
 	.uts_ns		= &init_uts_ns,					\
 	.mnt_ns		= NULL,						\
+	.syslog_ns	= &init_kernel_syslog_ns,			\
 	INIT_NET_NS(net_ns)                                             \
 	INIT_IPC_NS(ipc_ns)						\
 }

index 7b370c7..852fed3 100644
@@ -3,6 +3,7 @@
 
 #include <linux/spinlock.h>
 #include <linux/sched.h>
+#include <linux/syslog.h>
 
 struct mnt_namespace;
 struct uts_namespace;

@@ -29,6 +30,7 @@ struct nsproxy {
 	struct mnt_namespace *mnt_ns;
 	struct pid_namespace *pid_ns;
 	struct net 	     *net_ns;
+	struct syslog_ns     *syslog_ns;
 };
 extern struct nsproxy init_nsproxy;
 

index 864ff75..9268f96 100644
@@ -24,6 +24,7 @@ CFLAGS_REMOVE_sched_clock.o = -pg
 CFLAGS_REMOVE_perf_event.o = -pg
 endif
 
+obj-$(CONFIG_PRINTK) += syslog.o
 obj-$(CONFIG_FREEZER) += freezer.o
 obj-$(CONFIG_PROFILING) += profile.o
 obj-$(CONFIG_SYSCTL_SYSCALL_CHECK) += sysctl_check.o

index 09b4ff9..cd17cfb 100644
@@ -80,9 +80,17 @@ static struct nsproxy *create_new_namespaces(unsigned long flags,
 		err = PTR_ERR(new_nsp->net_ns);
 		goto out_net;
 	}
+	new_nsp->syslog_ns = copy_syslog_ns(flags, tsk->nsproxy->syslog_ns);
+	if (IS_ERR(new_nsp->syslog_ns)) {
+		err = PTR_ERR(new_nsp->syslog_ns);
+		goto out_syslog;
+	}
 
 	return new_nsp;
 
+out_syslog:
+	if (new_nsp->net_ns)
+		put_net(new_nsp->net_ns);
 out_net:
 	if (new_nsp->pid_ns)
 		put_pid_ns(new_nsp->pid_ns);

@@ -151,6 +159,8 @@ out:
 
 void free_nsproxy(struct nsproxy *ns)
 {
+	if (ns->syslog_ns)
+		put_syslog_ns(ns->syslog_ns);
 	if (ns->mnt_ns)
 		put_mnt_ns(ns->mnt_ns);
 	if (ns->uts_ns)

1.6.6