Audit: change type of audit_ever_enabled to bool

It's better to define audit_ever_enabled as bool.

Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
Audit: remove duplicate comments

Remove it.

Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
Audit: make audit kernel side netlink sock per userns

This patch try to make the audit_sock per user namespace,
not global.

Since sock is assigned to net namespace, when creating
a netns, we will allocate a audit_sock for the userns
which create this netns, and this netns will keep alive
until the creator userns being destroyed.

If userns creates many netns, the audit_sock is only
allocated once.

Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
netlink: Add compare function for netlink_table

As we know, netlink sockets are private resource of
net namespace, they can communicate with each other
only when they in the same net namespace. this works
well until we try to add namespace support for other
subsystems which use netlink.

Don't like ipv4 and route table.., it is not suited to
make these subsytems belong to net namespace, Such as
audit and crypto subsystems,they are more suitable to
user namespace.

So we must have the ability to make the netlink sockets
in same user namespace can communicate with each other.

This patch adds a new function pointer "compare" for
netlink_table, we can decide if the netlink sockets can
communicate with each other through this netlink_table
self-defined compare function.

The behavior isn't changed if we don't provide the compare
function for netlink_table.

Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
Audit: implement audit self-defined compare function

After this patch, audit netlink sockets can
communicate with each other when they belong
to the same user namespace.

Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
Audit: make audit_skb_queue per user namespace

After this patch, ervery user namespace has one
audit_skb_queue. Since we havn't finish the preparations,
only allow user to operate the skb queue of init user
namespace.

Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
Audit: make audit_skb_hold_queue per user namespace

After this patch, ervery user namespace has one
audit_skb_hold_queue. Since we havn't finish the
preparations, only allow user to operate the skb
hold queue of init user namespace.

Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
Audit: make kauditd_task per user namespace

This patch makes kauditd_task per user namespace,
Since right now we only allow user in init user
namesapce to send audit netlink message to kernel,
so actually the kauditd_task belongs to other user
namespace will still not run.

Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
Audit: make audit_nlk_portid per user namesapce

After this patch, audit_nlk_port is per user namespace.
Just like prev patch does,use audit_nlk_portid of init
user namespace in kauditd_send_skb.

Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
Audit: make audit_enabled per user namespace

This patch makes audit_enabled per user namespace,
Right now,use audit_enabled of init user namespace to
decide if audit is enabled no matter which user namespace
we belong to.

Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
Audit: make audit_ever_enabled per user namespace

We set audit_ever_enabled true after we enabled audit once.
and if audit_ever_enabled is true, we will allocate audit
context for task.

We should decide if to allocate audit context for tasks based on
if the audit is enabled once in the user namespace which the
task belongs to.

Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
Audit: make audit_initialized per user namespace

audit_initialized is used to identify if the audit
related resources have been initialized. it should
be per user namespace too.

Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
Audit: only allow init user namespace to change rate limit

Because We want to avoid the DoS attack caused by other user
namespace,so don't make audit_rate_limit per user namespace.
And only init user namespace has rights to change it.

Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
Audit: only allow init user namespace to change audit_failure

Setting audit_failure to AUDIT_FAIL_PANIC may
cause system panic.

We should disallow uninit user namesapce to change it.

Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
Audit: only allow init user namespace to change backlog_limit

Prevent un-init user namespace from generating lots of skb.

Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
Audit: make kauditd_wait per user namespace

kauditd_task is added to the wait queue kaudit_wait when
there is no audit message being generated in user namespace,
so the kaudit_wait should be per user namespace too.

Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
Audit: make audit_backlog_wait per user namespace

Tasks are added to audit_backlog_wait when the
audit_skb_queue of user namespace is full, so
audit_backlog_wait should be per user namespace too.

Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
Audit: introduce new audit logging interface for user namespace

This interface audit_log_start_ns and audit_log_end_ns
will be used for logging audit logs in user namespace.

Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
Audit: pass proper user namespace to audit_log_common_recv_msg

The audit log that generated in user namespace should be
received by the auditd running in this user namespace.

Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
Audit: Log audit config change in uninit user namespace

This patch allow to log audit config change in
uninit user namespace.

Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>