Re: [PATCH v1 1/2] io_uring,audit: audit IORING_OP_FADVISE but not IORING_OP_MADVISE

On Fri, Jan 27, 2023 at 5:45 PM Jens Axboe <axboe(a)kernel.dk&gt; wrote: > On 1/27/23 3:35?PM, Paul Moore wrote: > > On Fri, Jan 27, 2023 at 12:24 PM Richard Guy Briggs <rgb(a)redhat.com&gt;

> >> Since FADVISE can truncate files and MADVISE operates on memory, > >> reverse > >> the audit_skip tags. > >> > >> Fixes: 5bd2182d58e9 ("audit,io_uring,io-wq: add some basic audit > >> support to io_uring") Signed-off-by: Richard Guy Briggs > >> <rgb(a)redhat.com&gt; > >> --- > >> > >> io_uring/opdef.c | 2 +- > >> 1 file changed, 1 insertion(+), 1 deletion(-) > >> > >> diff --git a/io_uring/opdef.c b/io_uring/opdef.c > >> index 3aa0d65c50e3..a2bf53b4a38a 100644 > >> --- a/io_uring/opdef.c > >> +++ b/io_uring/opdef.c > >> @@ -306,12 +306,12 @@ const struct io_op_def io_op_defs[] = { > >> > >> }, > >> [IORING_OP_FADVISE] = { > >> > >> .needs_file = 1, > >> > >> - .audit_skip = 1, > >> > >> .name = "FADVISE", > >> .prep = io_fadvise_prep, > >> .issue = io_fadvise, > >> > >> }, > > > > I've never used posix_fadvise() or the associated fadvise64*() > > syscalls, but from quickly reading the manpages and the > > generic_fadvise() function in the kernel I'm missing where the fadvise > > family of functions could be used to truncate a file, can you show me > > where this happens? The closest I can see is the manipulation of the > > page cache, but that shouldn't actually modify the file ... right? > > Yeah, honestly not sure where that came from. Maybe it's being mixed up > with fallocate? That was my thought too when I was looking at it.

> All fadvise (or madvise, for that matter) does is > provide hints on the caching or access pattern. On second thought, both > of these should be able to set audit_skip as far as I can tell. Agreed on the fadvise side, and probably the madvise side too, although the latter has more options/code to sift through so I'm curious to hear what analysis Richard has done on that one.