Audit, lxc containers and logged paths
Hello everybody,
I need to watch folders inside unprivileged linux containers. From what I know it's not possible to run audit inside a lxc guest, so I set up audit inside the host to log access to dirs using absolute path (e.g. /var/lib/lxc/mycontainer/rootfs/etc/) and it works, but giving a look at the logs I found that both the paths of the executable and the path that has been accessed are relative to the container (i.e. /bin/ls and /etc/passwd), so I don't have a clue of which is the container that generated the record. I could compare the uid that generated it whith the uids set for the containers, but it seems an ugly solution.
Can audit be configured for logging the absolute paths, or give me a hint of the container that generated the record?
Best regards
Michele
Sorry, forgot to mention:
Host is Ubuntu 14.04, while guests are different Ubuntu versions Audit is installed from Ubuntu repos (version 1:2.3.2-2ubuntu1)
Thank you
Il 30/06/2016 19:27, Michele Giacomoli ha scritto:
Quoted 8 lines
Hello everybody,
I need to watch folders inside unprivileged linux containers. From what I know it's not possible to run audit inside a lxc guest, so I set up audit inside the host to log access to dirs using absolute path (e.g.
/var/lib/lxc/mycontainer/rootfs/etc/) and it works, but giving a look at the logs I found that both the paths of the executable and the path that has been accessed are relative to the container (i.e./bin/lsand/etc/passwd), so I don't have a clue of which is the container that generated the record. I could compare the uid that generated it whith the uids set for the containers, but it seems an ugly solution.Can audit be configured for logging the absolute paths, or give me a hint of the container that generated the record?
Best regards
Michele
Quoted 1 line · Michele Giacomoli
Hello everybody,
Hi Michele,
Quoted 10 lines
I need to watch folders inside unprivileged linux containers. From what I know it's not possible to run audit inside a lxc guest, so I set up audit inside the host to log access to dirs using absolute path (e.g.
/var/lib/lxc/mycontainer/rootfs/etc/) and it works, but giving a look at the logs I found that both the paths of the executable and the path that has been accessed are relative to the container (i.e./bin/lsand/etc/passwd), so I don't have a clue of which is the container that generated the record. I could compare the uid that generated it whith the uids set for the containers, but it seems an ugly solution.
General topics surrounding this sort of issue have been discussed on this list over the last couple of year. The way things are currently set up you are correct in the current way to address this problem. The kernel currently has no concept of containers.
Quoted 2 lines
Can audit be configured for logging the absolute paths, or give me a hint of the container that generated the record?
There have been some proposals to address this sort of challenge, but there is no consensus yet. I'm doing a presentaiton at the Linux Security Summit in Toronto this year in August that will touch on some of these issues and how we might address them. Some approaches document the namespaces of events and others allow audit to run in the container.
(As to the follow-on reply, at this point the distribution is irrelevant since it isn't in the upstream kernel yet.)
Quoted 1 line
Michele
- RGB
--
Richard Guy Briggs <[email protected]>
Kernel Security Engineering, Base Operating Systems, Red Hat Remote, Ottawa, Canada
Voice: +1.647.777.2635, Internal: (81) 32635
Got it. Thank you very much Richard
Il 30/06/2016 20:09, Richard Guy Briggs ha scritto:
Quoted 38 lines · Michele Giacomoli
Quoted 1 line
Hello everybody,
Hi Michele,
Quoted 10 lines
I need to watch folders inside unprivileged linux containers. From what I know it's not possible to run audit inside a lxc guest, so I set up audit inside the host to log access to dirs using absolute path (e.g.
/var/lib/lxc/mycontainer/rootfs/etc/) and it works, but giving a look at the logs I found that both the paths of the executable and the path that has been accessed are relative to the container (i.e./bin/lsand/etc/passwd), so I don't have a clue of which is the container that generated the record. I could compare the uid that generated it whith the uids set for the containers, but it seems an ugly solution.General topics surrounding this sort of issue have been discussed on this list over the last couple of year. The way things are currently set up you are correct in the current way to address this problem. The kernel currently has no concept of containers.
Quoted 2 lines
Can audit be configured for logging the absolute paths, or give me a hint of the container that generated the record?
There have been some proposals to address this sort of challenge, but there is no consensus yet. I'm doing a presentaiton at the Linux Security Summit in Toronto this year in August that will touch on some of these issues and how we might address them. Some approaches document the namespaces of events and others allow audit to run in the container.
(As to the follow-on reply, at this point the distribution is irrelevant since it isn't in the upstream kernel yet.)
Quoted 1 line
Michele
- RGB
--
Richard Guy Briggs <[email protected]>
Kernel Security Engineering, Base Operating Systems, Red Hat Remote, Ottawa, Canada
Voice: +1.647.777.2635, Internal: (81) 32635