On Wed, Oct 9, 2024 at 5:34 PM Florian Westphal <fw@xxxxxxxxx> wrote: > Richard Weinberger <richard@xxxxxx> wrote: > > When recording audit events for new outgoing connections, > > it is helpful to log the user info of the associated socket, > > if available. > > Therefore, check if the skb has a socket, and if it does, > > log the owning fsuid/fsgid. > > AFAIK audit isn't namespace aware at all (neither netns nor userns), so I > wonder how to handle this. > > We can't reject adding a -j AUDIT rule for non-init-net (we could, but I'm sure > it'll break some setups...). > > But I wonder if we should at least skip the uid if the user namespace is > 'something else'. This isn't unique to netfilter and the approach we take in the rest of audit is to always display UIDs/GIDs in the context of the init_user_ns; grep for from_kuid() in kernel/audit*.c. -- paul-moore.com
