Re: [PATCH v1 1/2] io_uring, audit: audit IORING_OP_FADVISE but not IORING_OP_MADVISE

On 1/27/23 3:35?PM, Paul Moore wrote: > On Fri, Jan 27, 2023 at 12:24 PM Richard Guy Briggs <rgb(a)redhat.com&gt; wrote: >> >> Since FADVISE can truncate files and MADVISE operates on memory, reverse >> the audit_skip tags. >> >> Fixes: 5bd2182d58e9 ("audit,io_uring,io-wq: add some basic audit support to io_uring") >> Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com&gt; >> --- >> io_uring/opdef.c | 2 +- >> 1 file changed, 1 insertion(+), 1 deletion(-) >> >> diff --git a/io_uring/opdef.c b/io_uring/opdef.c >> index 3aa0d65c50e3..a2bf53b4a38a 100644 >> --- a/io_uring/opdef.c >> +++ b/io_uring/opdef.c >> @@ -306,12 +306,12 @@ const struct io_op_def io_op_defs[] = { >> }, >> [IORING_OP_FADVISE] = { >> .needs_file = 1, >> - .audit_skip = 1, >> .name = "FADVISE", >> .prep = io_fadvise_prep, >> .issue = io_fadvise, >> }, > > I've never used posix_fadvise() or the associated fadvise64*() > syscalls, but from quickly reading the manpages and the > generic_fadvise() function in the kernel I'm missing where the fadvise > family of functions could be used to truncate a file, can you show me > where this happens? The closest I can see is the manipulation of the > page cache, but that shouldn't actually modify the file ... right? Yeah, honestly not sure where that came from. Maybe it's being mixed up with fallocate?

All fadvise (or madvise, for that matter) does is provide hints on the caching or access pattern. On second thought, both of these should be able to set audit_skip as far as I can tell.