• D
    Log an audit message with the LXC init pid · a6158336
    Daniel P. Berrange 提交于
    Currently the LXC driver logs audit messages when a container
    is started or stopped. These audit messages, however, contain
    the PID of the libvirt_lxc supervisor process. To enable
    sysadmins to correlate with audit messages generated by
    processes /inside/ the container, we need to include the
    container init process PID.
    
    We can't do this in the main 'start' audit message, since
    the init PID is not available at that point. Instead we output
    a completely new audit record, that lists both PIDs.
    
    type=VIRT_CONTROL msg=audit(1353433750.071:363): pid=20180 uid=0 auid=501 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='virt=lxc op=init vm="busy" uuid=dda7b947-0846-1759-2873-0f375df7d7eb vm-pid=20371 init-pid=20372 exe="/home/berrange/src/virt/libvirt/daemon/.libs/lt-libvirtd" hostname=? addr=? terminal=pts/6 res=success'
    Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>
    a6158336
domain_audit.c 20.3 KB