Re: [RFC PATCH 1/3] audit: remove arch_f pointer from struct audit_krule

On Sun, Nov 25, 2018 at 12:11 PM Richard Guy Briggs <rgb(a)redhat.com&gt; wrote: > On 2018-02-15 15:42, Paul Moore wrote: > > On Mon, Feb 12, 2018 at 7:29 AM, Richard Guy Briggs <rgb(a)redhat.com&gt; wrote: > > > The arch_f pointer was added to the struct audit_krule in commit: > > > e54dc2431d740a79a6bd013babade99d71b1714f ("audit signal recipients") > > > > > > This is only used on addition and deletion of rules which isn't time > > > critical and the arch field is likely to be one of the first fields, > > > easily found iterating over the field type. This isn't worth the > > > additional complexity and storage. Delete the field. > > > > > > Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com&gt; > > > --- > > > include/linux/audit.h | 1 - > > > kernel/auditfilter.c | 12 ++++++++---- > > > 2 files changed, 8 insertions(+), 5 deletions(-) > > > > I haven't decided if I like the removal of arch_f or not, but I think > > I might know where your oops/panic is coming from, thoughts below ... > > Have you decided yet if you like the removal of the arch_f pointer or > not? An updated v2 was provided the following day: > https://www.redhat.com/archives/linux-audit/2018-February/msg00059.html I still think I'd like to keep it as-is for now.

paul moore