On Wed, Mar 06, 2013 at 09:19:08AM -0700, Eric Blake wrote:
> On 03/06/2013 08:10 AM, Daniel P. Berrange wrote:
> > From: "Daniel P. Berrange" <berrange@xxxxxxxxxx>
> >
> > To allow the efficient correlation of container audit messages
> > with host hosts, include the pid namespace inode in audit
> > messages.
> >
> > The resulting audit message will be
> >
> > type=VIRT_CONTROL msg=audit(1362582468.378:50): pid=19284 uid=0 auid=0 ses=312 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='virt=lxc op=init vm="demo" uuid=0770f019-2d4e-09e9-8e4a-719e12b3a18e vm-pid=19620 init-pid=19622 pid-ns=23434 exe="/home/berrange/src/virt/libvirt/daemon/.libs/lt-libvirtd" hostname=? addr=? terminal=pts/6 res=success'
> >
> > Note the 'pid-ns' field showing the inode number of the PID
> > namespace of the container init process. Since /proc/PID/ns/pid
> > doesn't exist on older kernels, we keep the previous 'init-pid'
> > field too, showing the host PID of the init process.
> >
>
> > @@ -637,8 +667,20 @@ static void virLXCProcessMonitorInitNotify(virLXCMonitorPtr mon ATTRIBUTE_UNUSED
> > virDomainObjPtr vm)
> > {
> > virLXCDomainObjPrivatePtr priv = vm->privateData;
> > + ino_t inode;
> > +
> > priv->initpid = initpid;
> > - virDomainAuditInit(vm, initpid);
> > +
> > + if (virLXCProcessGetNsInode(initpid, "pid", &inode) < 0) {
> > + virErrorPtr err = virGetLastError();
> > + VIR_WARN("Cannot obtain pid NS inode for %llu: %s",
> > + (unsigned long long)initpid,
> > + err && err->message ? err->message : "<unknown>");
> > + virResetLastError();
>
> So if we fail because the kernel is too old, inode is left uninitialized...
>
> > + } else {
> > + inode = 0;
>
> ...and if we succeed on a new kernel, we wipe out the kernel's answer
> with a forced 0. Oops.
>
> Drop the one line '} else {', and the logic will be fixed.
Hah, yes, of course :-)
Daniel
--
|: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :|
|: http://libvirt.org -o- http://virt-manager.org :|
|: http://autobuild.org -o- http://search.cpan.org/~danberr/ :|
|: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|
--
libvir-list mailing list
libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list