On 03/06/2013 08:10 AM, Daniel P. Berrange wrote:
From: "Daniel P. Berrange" <berrange@redhat.com>
To allow the efficient correlation of container audit messages with host hosts, include the pid namespace inode in audit messages.
The resulting audit message will be
type=VIRT_CONTROL msg=audit(1362582468.378:50): pid=19284 uid=0 auid=0 ses=312 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='virt=lxc op=init vm="demo" uuid=0770f019-2d4e-09e9-8e4a-719e12b3a18e vm-pid=19620 init-pid=19622 pid-ns=23434 exe="/home/berrange/src/virt/libvirt/daemon/.libs/lt-libvirtd" hostname=? addr=? terminal=pts/6 res=success'
Note the 'pid-ns' field showing the inode number of the PID namespace of the container init process. Since /proc/PID/ns/pid doesn't exist on older kernels, we keep the previous 'init-pid' field too, showing the host PID of the init process.
@@ -637,8 +667,20 @@ static void virLXCProcessMonitorInitNotify(virLXCMonitorPtr mon ATTRIBUTE_UNUSED virDomainObjPtr vm) { virLXCDomainObjPrivatePtr priv = vm->privateData; + ino_t inode; + priv->initpid = initpid; - virDomainAuditInit(vm, initpid); + + if (virLXCProcessGetNsInode(initpid, "pid", &inode) < 0) { + virErrorPtr err = virGetLastError(); + VIR_WARN("Cannot obtain pid NS inode for %llu: %s", + (unsigned long long)initpid, + err && err->message ? err->message : "<unknown>"); + virResetLastError();
So if we fail because the kernel is too old, inode is left uninitialized...
+ } else { + inode = 0;
...and if we succeed on a new kernel, we wipe out the kernel's answer with a forced 0. Oops. Drop the one line '} else {', and the logic will be fixed. ACK with that change. -- Eric Blake eblake redhat com +1-919-301-3266 Libvirt virtualization library http://libvirt.org