Re: [PATCH 2/2] audit: Enable cacheing of cmdline in audit_context

Not enitrely sure if this is getting us any benefit, as in my environment, these contexts are getting free'd immediately. Change-Id: Ia0d432bc4aba8588840f0dc0026a1e9483e5b485 Signed-off-by: William Roberts <wroberts(a)tresys.com&gt; --- kernel/auditsc.c | 48 +++++++++++++++++++++++++++++++++++++----------- 1 file changed, 37 insertions(+), 11 deletions(-) diff --git a/kernel/auditsc.c b/kernel/auditsc.c index 45fd3d0..4b30c5d 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -270,6 +270,7 @@ struct audit_context { } mmap; }; int fds[2]; + unsigned long cmdline;

#if AUDIT_DEBUG int put_count; @@ -1044,6 +1045,14 @@ static inline void audit_free_aux(struct audit_context *context) } } +static inline void audit_cmdline_free(struct audit_context *ctx) +{ + if (!ctx->cmdline) + return; + free_page(ctx->cmdline); + ctx->cmdline = 0;

+} + static inline void audit_zero_context(struct audit_context *context, enum audit_state state) { @@ -1118,6 +1127,7 @@ static inline void audit_free_context(struct audit_context *context) audit_free_aux(context); kfree(context->filterkey); kfree(context->sockaddr); + audit_cmdline_free(context); kfree(context); context = previous; } while (context); @@ -1154,35 +1164,51 @@ error_path: EXPORT_SYMBOL(audit_log_task_context); -static void audit_log_add_cmdline(struct audit_buffer *ab, +static unsigned long audit_cmdline_get_page(struct audit_buffer *ab,

struct task_struct *tsk) { int len; unsigned long page; - char *msg = "(null)"; - - audit_log_format(ab, " cmdline="); /* Get the process cmdline */ page = __get_free_page(GFP_TEMPORARY); if (!page) { - audit_log_untrustedstring(ab, msg); - return; + return 0;

} len = proc_pid_cmdline(tsk, (char *)page); if (len <= 0) { free_page(page); - audit_log_untrustedstring(ab, msg); - return; + return 0;

} /* * Ensure NULL terminated! Application could * could be using setproctitle(3). */ ((char *)page)[len-1] = '\0'; - msg = (char *)page; + + /* TODO: Re-alloc to something smaller then a page here? */ + return page; +} + +static void audit_log_cmdline(struct audit_buffer *ab, struct task_struct *tsk, + struct audit_context *context) +{ + char *msg = "(null)"; + + audit_log_format(ab, " cmdline="); + + /* Already cached */ + if (context->cmdline) { + msg = (char *)context->cmdline;

+ goto out; + } + /* Not cached yet */ + context->cmdline = audit_cmdline_get_page(ab, tsk); + if (!context->cmdline) + goto out; + msg = (char *)context->cmdline;

+out: audit_log_untrustedstring(ab, msg); - free_page(page); } static void audit_log_task_info(struct audit_buffer *ab, struct task_struct *tsk) @@ -1211,7 +1237,6 @@ static void audit_log_task_info(struct audit_buffer *ab, struct task_struct *tsk } up_read(&mm->mmap_sem); } - audit_log_add_cmdline(ab, tsk); audit_log_task_context(ab); } @@ -1679,6 +1704,7 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts audit_log_task_info(ab, tsk); + audit_log_cmdline(ab, tsk, context); audit_log_key(ab, context->filterkey); audit_log_end(ab); -- 1.7.9.5