From owner-freebsd-security@freebsd.org  Wed Mar 14 13:12:32 2018
Return-Path: <owner-freebsd-security@freebsd.org>
Delivered-To: freebsd-security@mailman.ysv.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
 by mailman.ysv.freebsd.org (Postfix) with ESMTP id D2841F51102
 for <freebsd-security@mailman.ysv.freebsd.org>;
 Wed, 14 Mar 2018 13:12:32 +0000 (UTC)
 (envelope-from mpp302@gmail.com)
Received: from mail-lf0-f47.google.com (mail-lf0-f47.google.com
 [209.85.215.47])
 (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))
 (Client CN "smtp.gmail.com",
 Issuer "Google Internet Authority G2" (verified OK))
 by mx1.freebsd.org (Postfix) with ESMTPS id 442A47FFF8
 for <freebsd-security@freebsd.org>; Wed, 14 Mar 2018 13:12:32 +0000 (UTC)
 (envelope-from mpp302@gmail.com)
Received: by mail-lf0-f47.google.com with SMTP id h127-v6so4676620lfg.12
 for <freebsd-security@freebsd.org>; Wed, 14 Mar 2018 06:12:32 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=1e100.net; s=20161025;
 h=x-gm-message-state:date:from:to:cc:subject:message-id:in-reply-to
 :references:mime-version:content-transfer-encoding;
 bh=AkV9jOsgpYS0QofZa+If++Fg5+HpEL0zLFB82GG0LIc=;
 b=jfuDgnh/5sx6XeteGBxkfjbeo3aA9NnLqrkFOpZaL09GX4cJPNAS4+WSCMEbMDFyM9
 hVwzP89d+P4TgpVEqyWR0dU6hKYItVw0wzvTeZn5SFP3XKTQ8L/zpcO1X/JfKKFV2tDk
 +WCRxbXK71IsLk77tMCPGJEzszmG2U7c4pcFmESXViEcYsTzlMM2kQ0MH3LoJju/WuMv
 pASx+UvDTE6+JYd/O/ChYOfcQjTpeJuSHTq+D3bDWAidU/pB1g1LPaCqzquabdmYXVRi
 ZEKbxsZKCO4bhCHsvOlH6GhpOGFfW/XL8zMi1pFSrDYuU6a44s8+bj1YaISepAQ6Yu5+
 lq3g==
X-Gm-Message-State: AElRT7F3Jbd2M0H8sli26VQrZksZO3X6MyXNyXT76MP1h42Jg+GleaSJ
 o7Y6QoVcO16bVVWdC+d/j43xvDOL
X-Google-Smtp-Source: AG47ELv5iv7tkGFdLFSLzyIASNIVa/w95ha71JihdekGWg8paIitiD+GVktl7GCRJW9k1Zn0oe+LXQ==
X-Received: by 2002:a19:e9cc:: with SMTP id
 j73-v6mr3026622lfk.99.1521033144851; 
 Wed, 14 Mar 2018 06:12:24 -0700 (PDT)
Received: from oxy (89-76-8-18.dynamic.chello.pl. [89.76.8.18])
 by smtp.gmail.com with ESMTPSA id g192-v6sm624171lfg.55.2018.03.14.06.12.24
 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256);
 Wed, 14 Mar 2018 06:12:24 -0700 (PDT)
Date: Wed, 14 Mar 2018 14:13:01 +0100
From: Mateusz Piotrowski <0mp@FreeBSD.org>
To: Christian Peron <csjp@sqrt.ca>
Cc: Eitan Adler <lists@eitanadler.com>, "freebsd-security@freebsd.org"
 <freebsd-security@freebsd.org>
Subject: Re: auditing users within a jail
Message-ID: <20180314141301.7bdd2d3d@oxy>
In-Reply-To: <20180312031746.GB7114@cps-macbook-pro.lan>
References: <CAF6rxgmWWx-vQ9UDk4Uyk9SfxXBNtirtCEW6bixpS-akkn+wCw@mail.gmail.com>
 <20180312031746.GB7114@cps-macbook-pro.lan>
X-Mailer: Claws Mail 3.16.0 (GTK+ 2.24.31; amd64-portbld-freebsd12.0)
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.25
Precedence: list
List-Id: "Security issues \[members-only posting\]"
 <freebsd-security.freebsd.org>
List-Unsubscribe: <https://lists.freebsd.org/mailman/options/freebsd-security>, 
 <mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security/>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <https://lists.freebsd.org/mailman/listinfo/freebsd-security>, 
 <mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 14 Mar 2018 13:12:33 -0000

On Sun, 11 Mar 2018 22:17:47 -0500
Christian Peron <csjp@sqrt.ca> wrote:

>However, it is possible for processes in jails to produce audit
>records. The processes just need an audit mask. Since audit masks
>(configurations) are inherited across forks, you could set a global
>audit configuration for the jail using the following tool (or
>something like it):
>
>https://github.com/csjayp/setaudit (I just dropped it on to github)

FYI, I'll submit a new setaudit port if Christian decides to pull in my
enhancements.