Re: [PATCH v3 2/2] IMA: Add audit log for failure conditions
On Wed, Jun 24, 2020 at 1:25 PM Lakshmi Ramasubramanian
<nramas(a)linux.microsoft.com> wrote:
On 6/23/20 12:58 PM, Mimi Zohar wrote:
Hi Steve\Paul,
>> Sample audit messages:
>>
>> [ 6.303048] audit: type=1804 audit(1592506281.627:2): pid=1 uid=0
>> auid=4294967295 ses=4294967295 subj=kernel op=measuring_key
>> cause=ENOMEM comm="swapper/0" name=".builtin_trusted_keys"
res=0
>> errno=-12
>
> My only concern is that auditing -ENOMEM will put additional memory
> pressure on the system. I'm not sure if this is a concern and, if so,
> how it should be handled.
Do you have any concerns with respect to adding audit messages in low
memory conditions?
Assuming the system is not completely toast, the allocation failure
could be a very transient issue; I wouldn't worry too much about it.
--
paul moore
www.paul-moore.com