On Sun, Mar 11, 2018 at 1:44 PM, F Rafi <farhani...@gmail.com> wrote: > So container support can be addressed by userspace changes alone Or will it > require kernel audit subsystem updates as well?
In order to associate container identifiers with kernel generated audit events, kernel changes are required. You may have seen discussion threads about this on the list, and more recently a partial RFC patchset from Richard Guy Briggs on this list as well. Of course there will likely be some additions to Steve's userspace tools to make sense of, and interpret, the additional container identifiers in the audit log, but I expect the bulk of changes to happen in the kernel. There are a handful of issues in the GitHub audit-kernel issue tracker related to this work. > On Sun, Mar 11, 2018 at 1:08 PM Paul Moore <p...@paul-moore.com> wrote: >> >> On Sun, Mar 11, 2018 at 5:38 AM, Steve Grubb <sgr...@redhat.com> wrote: >> > Hello, >> > >> > I wanted to take a few minutes to chat about the future audit roadmap. >> > The release of audit-2.8.3 represents a breaking point ... >> >> Just a quick note that Steve is talking about the audit userspace >> which he maintains, the work for the Linux Kernel's audit subsystem is >> tracked via GitHub (link below). This includes both bug reports *and* >> new feature requests. If you would like to add to that list, feel >> free to do so. If you want to help out and contribute, definitely >> feel free to do so! ;) >> >> * https://github.com/linux-audit/audit-kernel/issues >> >> -- >> paul moore >> www.paul-moore.com >> >> -- >> Linux-audit mailing list >> Linuxfirstname.lastname@example.org >> https://www.redhat.com/mailman/listinfo/linux-audit -- paul moore www.paul-moore.com -- Linux-audit mailing list Linuxemail@example.com https://www.redhat.com/mailman/listinfo/linux-audit