[libvirt] [PATCH 3/3] audit: also audit cgroup controller path
Although the cgroup device ACL controller path can be worked out
by researching the code, it is more efficient to include that
information directly in the audit message.
* src/util/cgroup.h (virCgroupPathOfController): New prototype.
* src/util/cgroup.c (virCgroupPathOfController): Export.
* src/libvirt_private.syms: Likewise.
* src/qemu/qemu_audit.c (qemuDomainCgroupAudit): Use it.
---
src/libvirt_private.syms | 1 +
src/qemu/qemu_audit.c | 19 ++++++++++++++++---
src/util/cgroup.c | 8 ++++----
src/util/cgroup.h | 5 +++++
4 files changed, 26 insertions(+), 7 deletions(-)
diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms
index efcf3c5..c0da78e 100644
--- a/src/libvirt_private.syms
+++ b/src/libvirt_private.syms
@@ -79,6 +79,7 @@ virCgroupKill;
virCgroupKillRecursive;
virCgroupKillPainfully;
virCgroupMounted;
+virCgroupPathOfController;
virCgroupRemove;
virCgroupSetBlkioWeight;
virCgroupSetCpuShares;
diff --git a/src/qemu/qemu_audit.c b/src/qemu/qemu_audit.c
index 0d85fa7..c2402b5 100644
--- a/src/qemu/qemu_audit.c
+++ b/src/qemu/qemu_audit.c
@@ -188,13 +188,15 @@ cleanup:
* Log an audit message about an attempted cgroup device ACL change.
*/
void qemuDomainCgroupAudit(virDomainObjPtr vm,
- virCgroupPtr cgroup ATTRIBUTE_UNUSED,
+ virCgroupPtr cgroup,
const char *reason,
const char *extra,
bool success)
{
char uuidstr[VIR_UUID_STRING_BUFLEN];
char *vmname;
+ char *controller = NULL;
+ char *detail;
virUUIDFormat(vm->def->uuid, uuidstr);
if (!(vmname = virAuditEncode("vm", vm->def->name))) {
@@ -202,11 +204,22 @@ void qemuDomainCgroupAudit(virDomainObjPtr vm,
return;
}
+ virCgroupPathOfController(cgroup, VIR_CGROUP_CONTROLLER_DEVICES,
+ NULL, &controller);
+
+ if (!(detail = virAuditEncode("cgroup", VIR_AUDIT_STR(controller)))) {
+ VIR_WARN0("OOM while encoding audit message");
+ goto cleanup;
+ }
+
VIR_AUDIT(VIR_AUDIT_RECORD_RESOURCE, success,
- "resrc=cgroup reason=%s %s uuid=%s class=%s",
- reason, vmname, uuidstr, extra);
+ "resrc=cgroup reason=%s %s uuid=%s %s class=%s",
+ reason, vmname, uuidstr, detail, extra);
+cleanup:
VIR_FREE(vmname);
+ VIR_FREE(controller);
+ VIR_FREE(detail);
}
/**
diff --git a/src/util/cgroup.c b/src/util/cgroup.c
index c5b8cdd..a16b1ab 100644
--- a/src/util/cgroup.c
+++ b/src/util/cgroup.c
@@ -254,10 +254,10 @@ static int virCgroupDetect(virCgroupPtr group)
#endif
-static int virCgroupPathOfController(virCgroupPtr group,
- int controller,
- const char *key,
- char **path)
+int virCgroupPathOfController(virCgroupPtr group,
+ int controller,
+ const char *key,
+ char **path)
{
if (controller == -1) {
int i;
diff --git a/src/util/cgroup.h b/src/util/cgroup.h
index d468cb3..b3c5f27 100644
--- a/src/util/cgroup.h
+++ b/src/util/cgroup.h
@@ -40,6 +40,11 @@ int virCgroupForDomain(virCgroupPtr driver,
virCgroupPtr *group,
int create);
+int virCgroupPathOfController(virCgroupPtr group,
+ int controller,
+ const char *key,
+ char **path);
+
int virCgroupAddTask(virCgroupPtr group, pid_t pid);
int virCgroupSetBlkioWeight(virCgroupPtr group, unsigned int weight);
--
1.7.4