Re: [PATCH ghak90 V7 14/21] audit: contid check descendancy and nesting

On Thu, Oct 24, 2019 at 6:08 PM Richard Guy Briggs [off-list ref] wrote:

On 2019-10-10 20:40, Paul Moore wrote:

quoted

On Wed, Sep 18, 2019 at 9:26 PM Richard Guy Briggs [off-list ref] wrote:

quoted

?fixup! audit: convert to contid list to check for orch/engine ownership

?

quoted

Require the target task to be a descendant of the container
orchestrator/engine.

You would only change the audit container ID from one set or inherited
value to another if you were nesting containers.

If changing the contid, the container orchestrator/engine must be a
descendant and not same orchestrator as the one that set it so it is not
possible to change the contid of another orchestrator's container.

Did you mean to say that the container orchestrator must be an
ancestor of the target, and the same orchestrator as the one that set
the target process' audit container ID?

Not quite, the first half yes, but the second half: if it was already
set by that orchestrator, it can't be set again.  If it is a different
orchestrator that is a descendant of the orchestrator that set it, then
allow the action.

quoted

Or maybe I'm missing something about what you are trying to do?

Does that help clarify it?

I think so, it's pretty much as you stated originally: "Require the
target task to be a descendant of the container orchestrator/engine".
It's possible I misread something in the patch, or got lost in all the
?fixup! patching.  I'll take a closer look at the next revision of the
patchset to make sure the code makes sense to me, but the logic seems
reasonable.

-- 
paul moore
www.paul-moore.com