lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Wed, 7 Aug 2013 15:37:04 +0800 From: Rui Xiang <rui.xiang@...wei.com> To: <containers@...ts.linux-foundation.org>, <linux-kernel@...r.kernel.org> CC: <netdev@...r.kernel.org>, <netfilter-devel@...r.kernel.org>, <serge.hallyn@...ntu.com>, <ebiederm@...ssion.com>, <akpm@...ux-foundation.org>, <gaofeng@...fujitsu.com>, <guz.fnst@...fujitsu.com>, <libo.chen@...wei.com>, Rui Xiang <rui.xiang@...wei.com> Subject: [PATCH v3 00/11] Add namespace support for syslog This patchset introduces a system log namespace. In container scenario, all logs are exported to the ring buffer of host. Then logs belong to a contaier can't be distinguished. Sometimes, Some of our guest are administered by other sys-admin, that should not have access to these infomations. Syslog namespace is used to include a independent log buf own to a container, some logs which need to be displayed in container are stored to the buf, and others are all exported to HOST. The link of the 1st version is http://lwn.net/Articles/525728/. In that version, syslog_namespace was added into nsproxy and created through a new clone flag CLONE_SYSLOG when cloning a process. There were some discussion in last November about the 1st version. The 2nd version (http://lwn.net/Articles/561271/) used these important advice, and referred to Serge's patch (http://lwn.net/Articles/525629/). In this patchset, patch01-10 implement a mechanism for syslog_ns. Iptables is an actual scene to use syslog ns. So patch11 uses ns_printk interface to isolate logs. Syslog namespace is tied to a user namespace. And we must create a new user ns before create a new syslog ns, because that will make users have full capabilities in this new userns after cloning a new user ns. The syslog namespace can be created through a new command(11) to __NR_syslog syscall. That owe to a new syslog flag SYSLOG_ACTION_NEW_NS. In syslog_namespace, some necessary identifiers for handling syslog buf are containerized. When one container creates a new syslog ns, individual buf will be allocated to store log ownned this container. A new interface ns_printk is added to print the logs which we want to see in the container. Through ns_printk, we can get more logs related to a specific net ns, for instance, iptables. Here we use it to report iptable logs per contianer. Then default printk targeted at the init_syslog_ns will continue to print out most kernel log to host. One task in a new syslog ns could affect only current container through "dmesg", "dmesg -c" and /dev/kmsg actions. The read/write interface such as /dev/kmsg, /pro/kmsg and syslog syscall continue to be useful for container users. This patchset is based on linus' linux tree. v1 --> v2: -- Add syslog_ns to user namespace instead of nsproxy. -- Create syslog_ns through a new command(11) to __NR_syslog syscall instead of CLONE_SYSLOG. -- Alter related interfaces and parameters. v2 --> v3: -- Add some changlogs to illustrate the purpose of syslog ns. -- Add ns_printk_emit for namespace and make devkmsg_writev per namespace. -- Add ns_console_unlock for namespace. -- Put user ns while freeing syslog_ns. -- Use net instead of skb->dev->nd_net in sb_close. -- Clean up. Rui Xiang (11): syslog_ns: add syslog_namespace and put/get_syslog_ns syslog_ns: add syslog_ns into user_namespace syslog_ns: add init syslog_ns for global syslog syslog_ns: make syslog handling per namespace syslog_ns: make permisiion check per user namespace syslog_ns: use init syslog_ns for console action syslog_ns: implement function for creating syslog ns syslog_ns: implement ns_printk for specific syslog_ns syslog_ns: implement ns_printk_emit for specific syslog_ns syslog_ns: implement ns_console_unlock for specific syslog_ns netfilter: use ns_printk in iptable context fs/proc/kmsg.c | 17 +- include/linux/console.h | 1 + include/linux/printk.h | 11 +- include/linux/syslog.h | 81 ++++- include/linux/user_namespace.h | 2 + include/net/netfilter/xt_log.h | 6 +- kernel/printk.c | 784 +++++++++++++++++++++++++++-------------- kernel/sysctl.c | 3 +- kernel/user.c | 3 + kernel/user_namespace.c | 4 + net/netfilter/xt_LOG.c | 4 +- 11 files changed, 636 insertions(+), 280 deletions(-) -- 1.8.2.2 -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists