container create: add inspect data to event #16599

vrothberg · 2022-11-23T14:40:27Z

When the new events_container_create_inspect_data option is enabled in
containers.conf set the ContainersCreateInspectData event field for
each container-create event.

The data was requested for the purpose of auditing (e.g., intrusion detection).

Jira: https://issues.redhat.com/browse/RUN-1702
Signed-off-by: Valentin Rothberg [email protected]

Does this PR introduce a user-facing change?

When the new `event_audit_container_create` options is enabled in containers.conf, increase the verbosity of the container-create event by adding the inspect data of the container to the event.

vrothberg · 2022-11-23T14:40:43Z

containers/common#1243 needs to merge first.

vrothberg · 2022-11-23T14:59:30Z

As always, naming is the hardest part I guess.

@containers/podman-maintainers PTAL

giuseppe

LGTM

libpod/runtime_ctr.go

openshift-ci · 2022-11-23T15:28:13Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: giuseppe, vrothberg

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [giuseppe,vrothberg]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

mheon · 2022-11-23T15:57:27Z

We're going to absolutely murder the journal by doing this, but if it's what people want, I guess we have to deliver.

LGTM

flouthoc

IMHO I think the store and backend for audit logs should be separately configurable and should not be mixed the regular logs.

I think in most cases people would like to dump audit logs to a cheaper storage and use it only when needed. https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/#log-backend

But is separate store even applicable in podman do we have different events for audit ? Overall this is just an idea and not at all a blocker for this PR.

vrothberg · 2022-11-23T16:34:22Z

We're going to absolutely murder the journal by doing this, but if it's what people want, I guess we have to deliver.

That was brought up but does not seem to matter.

But is separate store even applicable in podman do we have different events for audit ? Overall this is just an idea and not at all a blocker for this PR.

The idea for a separate store is very interesting. For now, the goal is not have a holistic audit-logging (e.g., with including pulls, pushs, etc.) but to meet the use case. Adding the inspect data to the container-create event turned out to integrate well into already existing tooling for reading the journal while providing all possible data on which container is created with what image (digests etc.).

libpod/events.go

vrothberg · 2022-11-24T12:18:01Z

bin/rootlessport grew by 1262992 bytes; max allowed is 51200.

Unrelated to this change

Luap99 · 2022-11-24T12:22:21Z

bin/rootlessport grew by 1262992 bytes; max allowed is 51200.

Unrelated to this change

Huh? We should investigate why, rootlessport should be as small as possible. I guess it is caused by c/common changes so not a blocker for this PR but I would like to take a look if I find some time.

vrothberg · 2022-11-24T12:25:56Z

bin/rootlessport grew by 1262992 bytes; max allowed is 51200.

Unrelated to this change

Huh? We should investigate why, rootlessport should be as small as possible. I guess it is caused by c/common changes so not a blocker for this PR but I would like to take a look if I find some time.

Likely caused by containers/common#1239

vrothberg · 2022-11-24T13:01:11Z

[+1513s] [Fail] Verify podman containers.conf usage [It] regular capabilities
[+1513s] /var/tmp/go/src/github.com/containers/podman/test/e2e/containers_conf_test.go:114

Gnah, will fix that in another PR.

vrothberg · 2022-11-24T13:17:35Z

-> #16610 need this in first

libpod/events/config.go

vrothberg · 2022-11-28T13:01:51Z

Ready for review/merge ✔️

Luap99

LGTM

mheon · 2022-11-28T14:38:33Z

libpod/events.go

+			return nil
+		}()
+		if err != nil {
+			logrus.Errorf("Unable to add inspect data to container-create event: %v", err)


Seems like a customer who wants full audit data would prefer that container creation actually fail if we can't provide this?

I was contemplating it but couldn't decide. But you changed my mind. I also believe it's valid to fail in this case.

Done. Note that I was very careful not to change other callers to write events. Almost all are using defer and changing that would be a (too) big PR.

I also took the occasion to rename PODMAN_CONTAINER_CREATE_INSPECT_DATA to PODMAN_CONTAINER_INSPECT_DATA ... just in case we want more container events to contain this data in the future.

When the new `events_container_create_inspect_data` option is enabled in containers.conf set the `ContainersInspectData` event field for each container-create event. The data was requested for the purpose of auditing (e.g., intrusion detection). Jira: https://issues.redhat.com/browse/RUN-1702 Signed-off-by: Valentin Rothberg <[email protected]>

baude · 2022-11-29T14:07:34Z

/lgtm

openshift-ci bot added do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. release-note approved Indicates a PR has been approved by an approver from all required OWNERS files. labels Nov 23, 2022

vrothberg force-pushed the RUN-1702 branch from d2f51d3 to b612e03 Compare November 23, 2022 14:54

giuseppe approved these changes Nov 23, 2022

View reviewed changes

libpod/runtime_ctr.go Show resolved Hide resolved

flouthoc reviewed Nov 23, 2022

View reviewed changes

Luap99 reviewed Nov 23, 2022

View reviewed changes

libpod/events.go Outdated Show resolved Hide resolved

vrothberg force-pushed the RUN-1702 branch from b612e03 to 849d15b Compare November 24, 2022 12:04

vrothberg added the bloat_approved Approve a PR in which binary file size grows by over 50k label Nov 24, 2022

vrothberg force-pushed the RUN-1702 branch from 849d15b to 13bb9d1 Compare November 25, 2022 11:05

Luap99 reviewed Nov 25, 2022

View reviewed changes

libpod/events/config.go Outdated Show resolved Hide resolved

vrothberg force-pushed the RUN-1702 branch from 13bb9d1 to e20b57e Compare November 28, 2022 12:47

openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Nov 28, 2022

vrothberg force-pushed the RUN-1702 branch from e20b57e to f57c254 Compare November 28, 2022 13:01

openshift-merge-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Nov 28, 2022

vrothberg marked this pull request as ready for review November 28, 2022 13:01

openshift-ci bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Nov 28, 2022

Luap99 reviewed Nov 28, 2022

View reviewed changes

mheon reviewed Nov 28, 2022

View reviewed changes

openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Nov 28, 2022

vrothberg force-pushed the RUN-1702 branch from f57c254 to 267fdf2 Compare November 29, 2022 09:35

vrothberg force-pushed the RUN-1702 branch from 267fdf2 to 71f92d2 Compare November 29, 2022 09:40

openshift-merge-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Nov 29, 2022

openshift-ci bot assigned baude Nov 29, 2022

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Nov 29, 2022

openshift-merge-robot merged commit e15ffc1 into containers:main Nov 29, 2022

vrothberg deleted the RUN-1702 branch November 29, 2022 14:33

github-actions bot added the locked - please file new issue/PR Assist humans wanting to comment on an old issue or PR with locked comments. label Sep 20, 2023

github-actions bot locked as resolved and limited conversation to collaborators Sep 20, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

container create: add inspect data to event #16599

container create: add inspect data to event #16599

vrothberg commented Nov 23, 2022 •

edited

Loading

vrothberg commented Nov 23, 2022

vrothberg commented Nov 23, 2022

giuseppe left a comment

openshift-ci bot commented Nov 23, 2022

mheon commented Nov 23, 2022

flouthoc left a comment •

edited

Loading

vrothberg commented Nov 23, 2022

vrothberg commented Nov 24, 2022

Luap99 commented Nov 24, 2022

vrothberg commented Nov 24, 2022

vrothberg commented Nov 24, 2022

vrothberg commented Nov 24, 2022

vrothberg commented Nov 28, 2022

Luap99 left a comment

mheon Nov 28, 2022

vrothberg Nov 28, 2022

vrothberg Nov 29, 2022

baude commented Nov 29, 2022

container create: add inspect data to event #16599

container create: add inspect data to event #16599

Conversation

vrothberg commented Nov 23, 2022 • edited Loading

Does this PR introduce a user-facing change?

vrothberg commented Nov 23, 2022

vrothberg commented Nov 23, 2022

giuseppe left a comment

Choose a reason for hiding this comment

openshift-ci bot commented Nov 23, 2022

mheon commented Nov 23, 2022

flouthoc left a comment • edited Loading

Choose a reason for hiding this comment

vrothberg commented Nov 23, 2022

vrothberg commented Nov 24, 2022

Luap99 commented Nov 24, 2022

vrothberg commented Nov 24, 2022

vrothberg commented Nov 24, 2022

vrothberg commented Nov 24, 2022

vrothberg commented Nov 28, 2022

Luap99 left a comment

Choose a reason for hiding this comment

mheon Nov 28, 2022

Choose a reason for hiding this comment

vrothberg Nov 28, 2022

Choose a reason for hiding this comment

vrothberg Nov 29, 2022

Choose a reason for hiding this comment

baude commented Nov 29, 2022

vrothberg commented Nov 23, 2022 •

edited

Loading

flouthoc left a comment •

edited

Loading