From: Gao feng <gaofeng@cn.fujitsu.com>
To: eparis@redhat.com, rgb@redhat.com
Cc: linux-audit@redhat.com, linux-kernel@vger.kernel.org,
containers@lists.linux-foundation.org, ebiederm@xmission.com,
serge.hallyn@ubuntu.com, sgrubb@redhat.com,
Gao feng <gaofeng@cn.fujitsu.com>
Subject: [PATCH audit-next 2/2] Audit: make audit netlink socket net namespace unaware
Date: Thu, 9 Jan 2014 17:11:31 +0800 [thread overview]
Message-ID: <1389258691-2680-2-git-send-email-gaofeng@cn.fujitsu.com> (raw)
In-Reply-To: <1389258691-2680-1-git-send-email-gaofeng@cn.fujitsu.com>
Add a compare function which always return true for
audit netlink socket, this will cause audit netlink
sockets netns unaware, and no matter which netns the
user space audit netlink sockets belong to, they all
can find out and communicate with audit_sock.
This gets rid of the necessary to create per-netns
audit kernel side socket(audit_sock), it's pain to
depend on and get reference of netns for auditns.
Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
---
kernel/audit.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/kernel/audit.c b/kernel/audit.c
index b62153a..2ac6212 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -1064,12 +1064,18 @@ static void audit_receive(struct sk_buff *skb)
mutex_unlock(&audit_cmd_mutex);
}
+static bool audit_compare(struct net *net, struct sock *sk)
+{
+ return true;
+}
+
/* Initialize audit support at boot time. */
static int __init audit_init(void)
{
int i;
struct netlink_kernel_cfg cfg = {
.input = audit_receive,
+ .compare = audit_compare,
};
if (audit_initialized == AUDIT_DISABLED)
--
1.8.4.2
next prev parent reply other threads:[~2014-01-09 9:12 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-01-09 9:11 [PATCH audit-next 1/2] audit: revert commit listen in all network namespaces Gao feng
2014-01-09 9:11 ` Gao feng [this message]
2014-01-16 22:29 ` [PATCH audit-next 2/2] Audit: make audit netlink socket net namespace unaware Serge E. Hallyn
2014-01-17 1:37 ` Gao feng
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1389258691-2680-2-git-send-email-gaofeng@cn.fujitsu.com \
--to=gaofeng@cn.fujitsu.com \
--cc=containers@lists.linux-foundation.org \
--cc=ebiederm@xmission.com \
--cc=eparis@redhat.com \
--cc=linux-audit@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=rgb@redhat.com \
--cc=serge.hallyn@ubuntu.com \
--cc=sgrubb@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®