shaba/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2024-12-25 01:34:28 +03:00
Code

audit: since nspawn now sets CAP_AUDIT_CONTROL for containers we cannot user this anymore to skip audit session ID retrieval

Browse Source 
As audit is still broken in containers we need a reliable way how we can
determine whether the audit data we read from 7proc is actually useful.
Previously we used CAP_AUDIT_CONTROL for this, since nspawn removed that
from the nspawn container. This has changed a while back however, which
means we used audit data of host system in the container.

This adds an explicit container check to the audit calls, so that all
audit data is turned off in containers.

This should fix session creation with pam_systemd/logind in nspawn containers.
This commit is contained in:
Lennart Poettering 2013-04-15 21:55:12 +02:00
parent 7a9ec5c902
commit 9a3ef988b8
1 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
src/shared/audit.c
View File

@ -34,6 +34,7 @@
#include "util.h"
#include "log.h"
#include "fileio.h"
#include "virt.h"
int audit_session_from_pid(pid_t pid, uint32_t *id) {
char *s;
@ -45,6 +46,10 @@ int audit_session_from_pid(pid_t pid, uint32_t *id) {
if (have_effective_cap(CAP_AUDIT_CONTROL) <= 0)
return -ENOENT;
/* Audit doesn't support containers right now */
if (detect_container(NULL) > 0)
return -ENOTSUP;
if (pid == 0)
r = read_one_line_file("/proc/self/sessionid", &s);
else {
@ -90,6 +95,10 @@ int audit_loginuid_from_pid(pid_t pid, uid_t *uid) {
if (have_effective_cap(CAP_AUDIT_CONTROL) <= 0)
return -ENOENT;
/* Audit doesn't support containers right now */
if (detect_container(NULL) > 0)
return -ENOTSUP;
if (pid == 0)
r = read_one_line_file("/proc/self/loginuid", &s);
else {