Re: [PATCH] netfilter: Record uid and gid in xt_AUDIT

[Paul Moore]

On Wed, Oct 9, 2024 at 5:34 PM Florian Westphal <fw@xxxxxxxxx> wrote:
> Richard Weinberger <richard@xxxxxx> wrote:
> > When recording audit events for new outgoing connections,
> > it is helpful to log the user info of the associated socket,
> > if available.
> > Therefore, check if the skb has a socket, and if it does,
> > log the owning fsuid/fsgid.
>
> AFAIK audit isn't namespace aware at all (neither netns nor userns), so I
> wonder how to handle this.
>
> We can't reject adding a -j AUDIT rule for non-init-net (we could, but I'm sure
> it'll break some setups...).
>
> But I wonder if we should at least skip the uid if the user namespace is
> 'something else'.

This isn't unique to netfilter and the approach we take in the rest of
audit is to always display UIDs/GIDs in the context of the
init_user_ns; grep for from_kuid() in kernel/audit*.c.

-- 
paul-moore.com