[PATCH v3.4] - Updates on cmdline auditing patches
Patch 1 - Remains the same
Patch 2 - Updated the cache to use char* over unsigned long, but it still
caches a page
Patch 3 - Refactored the proc code, and the cache now uses kmalloc. Not sure if the new
refactored functions belong in base.c. They take a tas struct, so I am thinking
they should be relocated? Anyone have any thoughts on to where?
Patch 3 significantly droped the memory usage (before each got would have been 4096):
<snip>
<3>[ 27.891815] BILL req: 59 got: 64
<3>[ 27.897277] BILL req: 60 got: 64
<3>[ 27.902404] BILL req: 57 got: 64
<3>[ 27.907714] BILL req: 58 got: 64
<3>[ 27.912994] BILL req: 83 got: 128
<3>[ 27.918273] BILL req: 84 got: 128
<3>[ 27.923675] BILL req: 90 got: 128
<3>[ 27.929351] BILL req: 91 got: 128
<3>[ 27.939270] BILL req: 33 got: 64
<3>[ 27.944671] BILL req: 34 got: 64
<3>[ 27.951721] BILL req: 34 got: 64
<3>[ 27.958251] BILL req: 35 got: 64
<3>[ 27.963714] BILL req: 35 got: 64
<3>[ 27.969085] BILL req: 36 got: 64
<3>[ 27.989868] BILL req: 89 got: 128
<3>[ 27.995758] BILL req: 90 got: 128
<3>[ 28.001861] BILL req: 90 got: 128
<3>[ 28.007385] BILL req: 91 got: 128
<3>[ 28.019226] BILL req: 33 got: 64
<3>[ 28.029449] BILL req: 34 got: 64
<3>[ 28.034515] BILL req: 34 got: 64
<3>[ 28.039581] BILL req: 35 got: 64
<3>[ 28.044708] BILL req: 35 got: 64
<3>[ 28.049804] BILL req: 36 got: 64
<3>[ 31.352050] BILL req: 76 got: 128
Assuming they all stayed resident in the audit context
Total before:
102400
Total after:
2176
98% reduction in memory usage.
[PATCH 1/3] audit: Allow auditing of proc/self/cmdline value
[PATCH 2/3] audit: Enable cacheing of cmdline in audit_context
[PATCH 3/3] audit: dont allocate whole pages