External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2024-12-24 22:55:23 +00:00
Code Issues Packages Projects Releases Wiki Activity

audit: also audit cgroup controller path

Browse Source 
Although the cgroup device ACL controller path can be worked out
by researching the code, it is more efficient to include that
information directly in the audit message.

* src/util/cgroup.h (virCgroupPathOfController): New prototype.
* src/util/cgroup.c (virCgroupPathOfController): Export.
* src/libvirt_private.syms: Likewise.
* src/qemu/qemu_audit.c (qemuAuditCgroup): Use it.
This commit is contained in:
Eric Blake 2011-03-07 16:41:40 -07:00
parent d04916faae
commit f2512684ad
4 changed files with 22 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
src/libvirt_private.syms
View File

@ -79,6 +79,7 @@ virCgroupKill;
virCgroupKillRecursive; virCgroupKillRecursive;
virCgroupKillPainfully; virCgroupKillPainfully;
virCgroupMounted; virCgroupMounted;
virCgroupPathOfController;
virCgroupRemove; virCgroupRemove;
virCgroupSetBlkioWeight; virCgroupSetBlkioWeight;
virCgroupSetCpuShares; virCgroupSetCpuShares;

15
src/qemu/qemu_audit.c
View File

@ -213,11 +213,13 @@ cleanup:
* Log an audit message about an attempted cgroup device ACL change. * Log an audit message about an attempted cgroup device ACL change.
*/ */
void void
qemuAuditCgroup(virDomainObjPtr vm, virCgroupPtr cgroup ATTRIBUTE_UNUSED, qemuAuditCgroup(virDomainObjPtr vm, virCgroupPtr cgroup,
const char *reason, const char *extra, bool success) const char *reason, const char *extra, bool success)
{ {
char uuidstr[VIR_UUID_STRING_BUFLEN]; char uuidstr[VIR_UUID_STRING_BUFLEN];
char *vmname; char *vmname;
char *controller = NULL;
char *detail;
virUUIDFormat(vm->def->uuid, uuidstr); virUUIDFormat(vm->def->uuid, uuidstr);
if (!(vmname = virAuditEncode("vm", vm->def->name))) { if (!(vmname = virAuditEncode("vm", vm->def->name))) {
@ -225,11 +227,18 @@ qemuAuditCgroup(virDomainObjPtr vm, virCgroupPtr cgroup ATTRIBUTE_UNUSED,
return; return;
} }
virCgroupPathOfController(cgroup, VIR_CGROUP_CONTROLLER_DEVICES,
NULL, &controller);
detail = virAuditEncode("cgroup", VIR_AUDIT_STR(controller));
VIR_AUDIT(VIR_AUDIT_RECORD_RESOURCE, success, VIR_AUDIT(VIR_AUDIT_RECORD_RESOURCE, success,
"resrc=cgroup reason=%s %s uuid=%s class=%s", "resrc=cgroup reason=%s %s uuid=%s %s class=%s",
reason, vmname, uuidstr, extra); reason, vmname, uuidstr,
detail ? detail : "cgroup=?", extra);
VIR_FREE(vmname); VIR_FREE(vmname);
VIR_FREE(controller);
VIR_FREE(detail);
} }
/** /**

8
src/util/cgroup.c
View File

@ -254,10 +254,10 @@ static int virCgroupDetect(virCgroupPtr group)
#endif #endif
static int virCgroupPathOfController(virCgroupPtr group, int virCgroupPathOfController(virCgroupPtr group,
int controller, int controller,
const char *key, const char *key,
char **path) char **path)
{ {
if (controller == -1) { if (controller == -1) {
int i; int i;

5
src/util/cgroup.h
View File

@ -40,6 +40,11 @@ int virCgroupForDomain(virCgroupPtr driver,
virCgroupPtr *group, virCgroupPtr *group,
int create); int create);
int virCgroupPathOfController(virCgroupPtr group,
int controller,
const char *key,
char **path);
int virCgroupAddTask(virCgroupPtr group, pid_t pid); int virCgroupAddTask(virCgroupPtr group, pid_t pid);
int virCgroupSetBlkioWeight(virCgroupPtr group, unsigned int weight); int virCgroupSetBlkioWeight(virCgroupPtr group, unsigned int weight);