Paul Moore <paul@xxxxxxxxxxxxxx> wrote: > On Wed, Oct 9, 2024 at 5:34 PM Florian Westphal <fw@xxxxxxxxx> wrote: > > Richard Weinberger <richard@xxxxxx> wrote: > > > When recording audit events for new outgoing connections, > > > it is helpful to log the user info of the associated socket, > > > if available. > > > Therefore, check if the skb has a socket, and if it does, > > > log the owning fsuid/fsgid. > > > > AFAIK audit isn't namespace aware at all (neither netns nor userns), so I > > wonder how to handle this. > > > > We can't reject adding a -j AUDIT rule for non-init-net (we could, but I'm sure > > it'll break some setups...). > > > > But I wonder if we should at least skip the uid if the user namespace is > > 'something else'. > > This isn't unique to netfilter and the approach we take in the rest of > audit is to always display UIDs/GIDs in the context of the > init_user_ns; grep for from_kuid() in kernel/audit*.c. Hmm, audit_netlink_ok() bails with -ECONNREFUSED for current_user_ns() != &init_user_ns, so audit_log_common_recv_msg() won't be called from tasks that reside in a different userns. If you say its fine and audit can figure out that the retuned uid is not related to the initial user namespace, then ok. I was worried audit records could blame wrong/bogus user id.
