Current State of Kernel Audit and Linux Namespaces - Containers and Future Developments

Explore the evolution and future of kernel audit and Linux namespaces in this 46-minute conference talk by Richard Guy Briggs from Red Hat. Delve into the history of namespaces and audit, their relationship, and recent developments. Learn about the challenges and potential solutions for running audit in containers, including the concept of anchoring the audit daemon in the user namespace. Discover how identifying namespaces in audit messages can enhance tracking tools for container processes. Gain insights into the speaker's extensive experience with Linux and his current role as a Red Hat kernel security engineer. Cover topics such as usernamespaces, namespace IDs, container IDs, and the implications for distributions and docker micro-services.

Intro
History
What is Audit
Namespaces
Containers
The Problem
The Use Case
Usernamespaces
Namespace IDs
Container IDs
Conclusion
Who Cares
Namespace IDs vs Containers
Questions
Wrapup