2:51 a.m.
The following series writes audit messages directly to skb rather
than formatting to a tmp buffer, and copying to some number of skbs
(potentially fragmenting the message across skbs). This is done in
three steps.
1) audit-buffer-alloc.patch - adds simpler alloc/free helper functions
2) audit-buffer-expand.patch - moves to a dynamic tmp buffer which can
be expanded as needed. copy message to a single skb.
3) audit-buffer-skb.patch - eliminate tmp buffer and write directly to skb.
kernel/audit.c | 232 ++++++++++++++++++++++++++++-----------------------------
1 files changed, 118 insertions(+), 114 deletions(-)
thanks,
-chris
2:52 a.m.
New subject: [PATCH 1/3] helper functions to allocate and free audit_buffers
Add helper functions to allocate and free audit_buffers.
Signed-off-by: Chris Wright <chrisw(a)osdl.org>
---
kernel/audit.c | 61 +++++++++++++++++++++++++++++++++++---------------------- 1 files
changed, 38 insertions(+), 23 deletions(-)
kernel/audit.c: 9c4f1af0c794674404810d7caff0131218cbc950
--- k/kernel/audit.c
+++ l/kernel/audit.c
@@ -608,6 +608,42 @@ static int __init audit_enable(char *str
__setup("audit=", audit_enable);
+static void audit_buffer_free(struct audit_buffer *ab)
+{
+ unsigned long flags;
+
+ atomic_dec(&audit_backlog);
+ spin_lock_irqsave(&audit_freelist_lock, flags);
+ if (++audit_freelist_count > AUDIT_MAXFREE)
+ kfree(ab);
+ else
+ list_add(&ab->list, &audit_freelist);
+ spin_unlock_irqrestore(&audit_freelist_lock, flags);
+}
+
+static struct audit_buffer * audit_buffer_alloc(int gfp_mask)
+{
+ unsigned long flags;
+ struct audit_buffer *ab = NULL;
+
+ spin_lock_irqsave(&audit_freelist_lock, flags);
+ if (!list_empty(&audit_freelist)) {
+ ab = list_entry(audit_freelist.next,
+ struct audit_buffer, list);
+ list_del(&ab->list);
+ --audit_freelist_count;
+ }
+ spin_unlock_irqrestore(&audit_freelist_lock, flags);
+
+ if (!ab) {
+ ab = kmalloc(sizeof(*ab), GFP_ATOMIC);
+ if (!ab)
+ goto out;
+ }
+ atomic_inc(&audit_backlog);
+out:
+ return ab;
+}
/* Obtain an audit buffer. This routine does locking to obtain the
* audit buffer, but then no locking is required for calls to
@@ -618,7 +654,6 @@ __setup("audit=", audit_enable);
struct audit_buffer *audit_log_start(struct audit_context *ctx)
{
struct audit_buffer *ab = NULL;
- unsigned long flags;
struct timespec t;
unsigned int serial;
@@ -637,23 +672,12 @@ struct audit_buffer *audit_log_start(str
return NULL;
}
- spin_lock_irqsave(&audit_freelist_lock, flags);
- if (!list_empty(&audit_freelist)) {
- ab = list_entry(audit_freelist.next,
- struct audit_buffer, list);
- list_del(&ab->list);
- --audit_freelist_count;
- }
- spin_unlock_irqrestore(&audit_freelist_lock, flags);
-
- if (!ab)
- ab = kmalloc(sizeof(*ab), GFP_ATOMIC);
+ ab = audit_buffer_alloc(GFP_ATOMIC);
if (!ab) {
audit_log_lost("out of memory in audit_log_start");
return NULL;
}
- atomic_inc(&audit_backlog);
skb_queue_head_init(&ab->sklist);
ab->ctx = ctx;
@@ -812,8 +836,6 @@ static void audit_log_end_irq(struct aud
* be called in an irq context. */
static void audit_log_end_fast(struct audit_buffer *ab)
{
- unsigned long flags;
-
BUG_ON(in_irq());
if (!ab)
return;
@@ -824,14 +846,7 @@ static void audit_log_end_fast(struct au
if (audit_log_drain(ab))
return;
}
-
- atomic_dec(&audit_backlog);
- spin_lock_irqsave(&audit_freelist_lock, flags);
- if (++audit_freelist_count > AUDIT_MAXFREE)
- kfree(ab);
- else
- list_add(&ab->list, &audit_freelist);
- spin_unlock_irqrestore(&audit_freelist_lock, flags);
+ audit_buffer_free(ab);
}
/* Send or queue the message in the audit buffer, depending on the
2:54 a.m.
New subject: [PATCH 2/3] expand audit tmp buffer as needed
Introduce audit_expand and make the audit_buffer use a dynamic buffer
which can be resized. When audit buffer is moved to skb it will not
be fragmented across skb's, so we can eliminate the sklist in the
audit_buffer. During audit_log_move, we simply copy the full buffer
into a single skb, and then audit_log_drain sends it on.
Signed-off-by: Chris Wright <chrisw(a)osdl.org>
---
kernel/audit.c | 139 ++++++++++++++++++++++++++++++++-------------------------
1 files changed, 79 insertions(+), 60 deletions(-)
kernel/audit.c: 69f8ddb991df695d1f1c6ff32a2ee9bbd439286c
--- k/kernel/audit.c
+++ l/kernel/audit.c
@@ -132,14 +132,11 @@ static DECLARE_MUTEX(audit_netlink_sem);
* use simultaneously. */
struct audit_buffer {
struct list_head list;
- struct sk_buff_head sklist; /* formatted skbs ready to send */
+ struct sk_buff *skb; /* formatted skb ready to send */
struct audit_context *ctx; /* NULL or associated context */
int len; /* used area of tmp */
- char tmp[AUDIT_BUFSIZ];
-
- /* Pointer to header and contents */
- struct nlmsghdr *nlh;
- int total;
+ int size; /* size of tmp */
+ char *tmp;
int type;
int pid;
};
@@ -476,55 +473,47 @@ static void audit_receive(struct sock *s
static void audit_log_move(struct audit_buffer *ab)
{
struct sk_buff *skb;
+ struct nlmsghdr *nlh;
char *start;
- int extra = ab->nlh ? 0 : NLMSG_SPACE(0);
+ int len = NLMSG_SPACE(0) + ab->len + 1;
/* possible resubmission */
- if (ab->len == 0)
+ if (ab->skb)
return;
- skb = skb_peek_tail(&ab->sklist);
- if (!skb || skb_tailroom(skb) <= ab->len + extra) {
- skb = alloc_skb(2 * ab->len + extra, GFP_ATOMIC);
- if (!skb) {
- ab->len = 0; /* Lose information in ab->tmp */
- audit_log_lost("out of memory in audit_log_move");
- return;
- }
- __skb_queue_tail(&ab->sklist, skb);
- if (!ab->nlh)
- ab->nlh = (struct nlmsghdr *)skb_put(skb,
- NLMSG_SPACE(0));
+ skb = alloc_skb(len, GFP_ATOMIC);
+ if (!skb) {
+ /* Lose information in ab->tmp */
+ audit_log_lost("out of memory in audit_log_move");
+ return;
}
+ ab->skb = skb;
+ nlh = (struct nlmsghdr *)skb_put(skb, NLMSG_SPACE(0));
+ nlh->nlmsg_type = ab->type;
+ nlh->nlmsg_len = ab->len;
+ nlh->nlmsg_flags = 0;
+ nlh->nlmsg_pid = ab->pid;
+ nlh->nlmsg_seq = 0;
start = skb_put(skb, ab->len);
memcpy(start, ab->tmp, ab->len);
- ab->len = 0;
}
/* Iterate over the skbuff in the audit_buffer, sending their contents
* to user space. */
static inline int audit_log_drain(struct audit_buffer *ab)
{
- struct sk_buff *skb;
+ struct sk_buff *skb = ab->skb;
- while ((skb = skb_dequeue(&ab->sklist))) {
+ if (skb) {
int retval = 0;
if (audit_pid) {
- if (ab->nlh) {
- ab->nlh->nlmsg_len = ab->total;
- ab->nlh->nlmsg_type = ab->type;
- ab->nlh->nlmsg_flags = 0;
- ab->nlh->nlmsg_seq = 0;
- ab->nlh->nlmsg_pid = ab->pid;
- }
skb_get(skb); /* because netlink_* frees */
retval = netlink_unicast(audit_sock, skb, audit_pid,
MSG_DONTWAIT);
}
if (retval == -EAGAIN &&
(atomic_read(&audit_backlog)) < audit_backlog_limit) {
- skb_queue_head(&ab->sklist, skb);
audit_log_end_irq(ab);
return 1;
}
@@ -538,13 +527,12 @@ static inline int audit_log_drain(struct
audit_log_lost("netlink socket too busy");
}
if (!audit_pid) { /* No daemon */
- int offset = ab->nlh ? NLMSG_SPACE(0) : 0;
+ int offset = NLMSG_SPACE(0);
int len = skb->len - offset;
skb->data[offset + len] = '\0';
printk(KERN_ERR "%s\n", skb->data + offset);
}
kfree_skb(skb);
- ab->nlh = NULL;
}
return 0;
}
@@ -612,6 +600,10 @@ static void audit_buffer_free(struct aud
{
unsigned long flags;
+ if (!ab)
+ return;
+
+ kfree(ab->tmp);
atomic_dec(&audit_backlog);
spin_lock_irqsave(&audit_freelist_lock, flags);
if (++audit_freelist_count > AUDIT_MAXFREE)
@@ -621,7 +613,8 @@ static void audit_buffer_free(struct aud
spin_unlock_irqrestore(&audit_freelist_lock, flags);
}
-static struct audit_buffer * audit_buffer_alloc(int gfp_mask)
+static struct audit_buffer * audit_buffer_alloc(struct audit_context *ctx,
+ int gfp_mask)
{
unsigned long flags;
struct audit_buffer *ab = NULL;
@@ -638,11 +631,24 @@ static struct audit_buffer * audit_buffe
if (!ab) {
ab = kmalloc(sizeof(*ab), GFP_ATOMIC);
if (!ab)
- goto out;
+ goto err;
}
atomic_inc(&audit_backlog);
-out:
+
+ ab->tmp = kmalloc(AUDIT_BUFSIZ, GFP_ATOMIC);
+ if (!ab->tmp)
+ goto err;
+
+ ab->skb = NULL;
+ ab->ctx = ctx;
+ ab->len = 0;
+ ab->size = AUDIT_BUFSIZ;
+ ab->type = AUDIT_KERNEL;
+ ab->pid = 0;
return ab;
+err:
+ audit_buffer_free(ab);
+ return NULL;
}
/* Obtain an audit buffer. This routine does locking to obtain the
@@ -670,21 +678,12 @@ struct audit_buffer *audit_log_start(str
return NULL;
}
- ab = audit_buffer_alloc(GFP_ATOMIC);
+ ab = audit_buffer_alloc(ctx, GFP_ATOMIC);
if (!ab) {
audit_log_lost("out of memory in audit_log_start");
return NULL;
}
- skb_queue_head_init(&ab->sklist);
-
- ab->ctx = ctx;
- ab->len = 0;
- ab->nlh = NULL;
- ab->total = 0;
- ab->type = AUDIT_KERNEL;
- ab->pid = 0;
-
#ifdef CONFIG_AUDITSYSCALL
if (ab->ctx)
audit_get_stamp(ab->ctx, &t, &serial);
@@ -699,6 +698,27 @@ struct audit_buffer *audit_log_start(str
return ab;
}
+/**
+ * audit_expand - expand tmp buffer in the audit buffer
+ * @ab: audit_buffer
+ *
+ * Returns 0 (no space) on failed expansion, or available space if
+ * successful.
+ */
+static inline int audit_expand(struct audit_buffer *ab)
+{
+ char *tmp;
+ int len = ab->size + AUDIT_BUFSIZ;
+
+ tmp = kmalloc(len, GFP_ATOMIC);
+ if (!tmp)
+ return 0;
+ memcpy(tmp, ab->tmp, ab->len);
+ kfree(ab->tmp);
+ ab->tmp = tmp;
+ ab->size = len;
+ return ab->size - ab->len;
+}
/* Format an audit message into the audit buffer. If there isn't enough
* room in the audit buffer, more room will be allocated and vsnprint
@@ -712,22 +732,25 @@ static void audit_log_vformat(struct aud
if (!ab)
return;
- avail = sizeof(ab->tmp) - ab->len;
+ avail = ab->size - ab->len;
if (avail <= 0) {
- audit_log_move(ab);
- avail = sizeof(ab->tmp) - ab->len;
+ avail = audit_expand(ab);
+ if (!avail)
+ goto out;
}
- len = vsnprintf(ab->tmp + ab->len, avail, fmt, args);
+ len = vsnprintf(ab->tmp + ab->len, avail, fmt, args);
if (len >= avail) {
/* The printk buffer is 1024 bytes long, so if we get
* here and AUDIT_BUFSIZ is at least 1024, then we can
* log everything that printk could have logged. */
- audit_log_move(ab);
- avail = sizeof(ab->tmp) - ab->len;
- len = vsnprintf(ab->tmp + ab->len, avail, fmt, args);
+ avail = audit_expand(ab);
+ if (!avail)
+ goto out;
+ len = vsnprintf(ab->tmp + ab->len, avail, fmt, args);
}
ab->len += (len < avail) ? len : avail;
- ab->total += (len < avail) ? len : avail;
+out:
+ return;
}
/* Format a message into the audit buffer. All the work is done in
@@ -775,21 +798,19 @@ void audit_log_d_path(struct audit_buffe
char *p;
int len, avail;
- if (prefix) audit_log_format(ab, " %s", prefix);
+ if (prefix)
+ audit_log_format(ab, " %s", prefix);
- if (ab->len > 128)
- audit_log_move(ab);
- avail = sizeof(ab->tmp) - ab->len;
+ avail = ab->size - ab->len;
p = d_path(dentry, vfsmnt, ab->tmp + ab->len, avail);
if (IS_ERR(p)) {
/* FIXME: can we save some information here? */
audit_log_format(ab, "<toolong>");
} else {
/* path isn't at start of buffer */
- len = (ab->tmp + sizeof(ab->tmp) - 1) - p;
+ len = (ab->tmp + ab->size - 1) - p;
memmove(ab->tmp + ab->len, p, len);
ab->len += len;
- ab->total += len;
}
}
2:55 a.m.
New subject: [PATCH 3/3] buffer audit msgs directly to skb
Drop the use of a tmp buffer in the audit_buffer, and just buffer
directly to the skb. All header data that was temporarily stored in
the audit_buffer can now be stored directly in the netlink header in
the skb. Resize skb as needed. This eliminates the extra copy (and
the audit_log_move function which was responsible for copying).
Signed-off-by: Chris Wright <chrisw(a)osdl.org>
---
kernel/audit.c | 122 +++++++++++++++++++++------------------------------------ 1 files
changed, 46 insertions(+), 76 deletions(-)
kernel/audit.c: 24dbd7ce6967f002e15e8dd6d0b557563067a209
--- k/kernel/audit.c
+++ l/kernel/audit.c
@@ -134,16 +134,18 @@ struct audit_buffer {
struct list_head list;
struct sk_buff *skb; /* formatted skb ready to send */
struct audit_context *ctx; /* NULL or associated context */
- int len; /* used area of tmp */
- int size; /* size of tmp */
- char *tmp;
- int type;
- int pid;
};
void audit_set_type(struct audit_buffer *ab, int type)
{
- ab->type = type;
+ struct nlmsghdr *nlh = (struct nlmsghdr *)ab->skb->data;
+ nlh->nlmsg_type = type;
+}
+
+static void audit_set_pid(struct audit_buffer *ab, pid_t pid)
+{
+ struct nlmsghdr *nlh = (struct nlmsghdr *)ab->skb->data;
+ nlh->nlmsg_pid = pid;
}
struct audit_entry {
@@ -399,8 +401,8 @@ static int audit_receive_msg(struct sk_b
(int)(nlh->nlmsg_len
- ((char *)data - (char *)nlh)),
loginuid, (char *)data);
- ab->type = AUDIT_USER;
- ab->pid = pid;
+ audit_set_type(ab, AUDIT_USER);
+ audit_set_pid(ab, pid);
audit_log_end(ab);
break;
case AUDIT_ADD:
@@ -464,42 +466,7 @@ static void audit_receive(struct sock *s
up(&audit_netlink_sem);
}
-/* Move data from tmp buffer into an skb. This is an extra copy, and
- * that is unfortunate. However, the copy will only occur when a record
- * is being written to user space, which is already a high-overhead
- * operation. (Elimination of the copy is possible, for example, by
- * writing directly into a pre-allocated skb, at the cost of wasting
- * memory. */
-static void audit_log_move(struct audit_buffer *ab)
-{
- struct sk_buff *skb;
- struct nlmsghdr *nlh;
- char *start;
- int len = NLMSG_SPACE(0) + ab->len + 1;
-
- /* possible resubmission */
- if (ab->skb)
- return;
-
- skb = alloc_skb(len, GFP_ATOMIC);
- if (!skb) {
- /* Lose information in ab->tmp */
- audit_log_lost("out of memory in audit_log_move");
- return;
- }
- ab->skb = skb;
- nlh = (struct nlmsghdr *)skb_put(skb, NLMSG_SPACE(0));
- nlh->nlmsg_type = ab->type;
- nlh->nlmsg_len = ab->len;
- nlh->nlmsg_flags = 0;
- nlh->nlmsg_pid = ab->pid;
- nlh->nlmsg_seq = 0;
- start = skb_put(skb, ab->len);
- memcpy(start, ab->tmp, ab->len);
-}
-
-/* Iterate over the skbuff in the audit_buffer, sending their contents
- * to user space. */
+/* Grab skbuff from the audit_buffer and send to user space. */
static inline int audit_log_drain(struct audit_buffer *ab)
{
struct sk_buff *skb = ab->skb;
@@ -508,6 +475,8 @@ static inline int audit_log_drain(struct
int retval = 0;
if (audit_pid) {
+ struct nlmsghdr *nlh = (struct nlmsghdr *)skb->data;
+ nlh->nlmsg_len = skb->len;
skb_get(skb); /* because netlink_* frees */
retval = netlink_unicast(audit_sock, skb, audit_pid,
MSG_DONTWAIT);
@@ -532,7 +501,6 @@ static inline int audit_log_drain(struct
skb->data[offset + len] = '\0';
printk(KERN_ERR "%s\n", skb->data + offset);
}
- kfree_skb(skb);
}
return 0;
}
@@ -603,7 +571,8 @@ static void audit_buffer_free(struct aud
if (!ab)
return;
- kfree(ab->tmp);
+ if (ab->skb)
+ kfree_skb(ab->skb);
atomic_dec(&audit_backlog);
spin_lock_irqsave(&audit_freelist_lock, flags);
if (++audit_freelist_count > AUDIT_MAXFREE)
@@ -618,6 +587,7 @@ static struct audit_buffer * audit_buffe
{
unsigned long flags;
struct audit_buffer *ab = NULL;
+ struct nlmsghdr *nlh;
spin_lock_irqsave(&audit_freelist_lock, flags);
if (!list_empty(&audit_freelist)) {
@@ -635,16 +605,16 @@ static struct audit_buffer * audit_buffe
}
atomic_inc(&audit_backlog);
- ab->tmp = kmalloc(AUDIT_BUFSIZ, GFP_ATOMIC);
- if (!ab->tmp)
+ ab->skb = alloc_skb(AUDIT_BUFSIZ, GFP_ATOMIC);
+ if (!ab->skb)
goto err;
- ab->skb = NULL;
ab->ctx = ctx;
- ab->len = 0;
- ab->size = AUDIT_BUFSIZ;
- ab->type = AUDIT_KERNEL;
- ab->pid = 0;
+ nlh = (struct nlmsghdr *)skb_put(ab->skb, NLMSG_SPACE(0));
+ nlh->nlmsg_type = AUDIT_KERNEL;
+ nlh->nlmsg_flags = 0;
+ nlh->nlmsg_pid = 0;
+ nlh->nlmsg_seq = 0;
return ab;
err:
audit_buffer_free(ab);
@@ -699,7 +669,7 @@ struct audit_buffer *audit_log_start(str
}
/**
- * audit_expand - expand tmp buffer in the audit buffer
+ * audit_expand - expand skb in the audit buffer
* @ab: audit_buffer
*
* Returns 0 (no space) on failed expansion, or available space if
@@ -707,17 +677,14 @@ struct audit_buffer *audit_log_start(str
*/
static inline int audit_expand(struct audit_buffer *ab)
{
- char *tmp;
- int len = ab->size + AUDIT_BUFSIZ;
-
- tmp = kmalloc(len, GFP_ATOMIC);
- if (!tmp)
+ struct sk_buff *skb = ab->skb;
+ int ret = pskb_expand_head(skb, skb_headroom(skb), AUDIT_BUFSIZ,
+ GFP_ATOMIC);
+ if (ret < 0) {
+ audit_log_lost("out of memory in audit_expand");
return 0;
- memcpy(tmp, ab->tmp, ab->len);
- kfree(ab->tmp);
- ab->tmp = tmp;
- ab->size = len;
- return ab->size - ab->len;
+ }
+ return skb_tailroom(skb);
}
/* Format an audit message into the audit buffer. If there isn't enough
@@ -728,17 +695,20 @@ static void audit_log_vformat(struct aud
va_list args)
{
int len, avail;
+ struct sk_buff *skb;
if (!ab)
return;
- avail = ab->size - ab->len;
- if (avail <= 0) {
+ BUG_ON(!ab->skb);
+ skb = ab->skb;
+ avail = skb_tailroom(skb);
+ if (avail == 0) {
avail = audit_expand(ab);
if (!avail)
goto out;
}
- len = vsnprintf(ab->tmp + ab->len, avail, fmt, args);
+ len = vsnprintf(skb->tail, avail, fmt, args);
if (len >= avail) {
/* The printk buffer is 1024 bytes long, so if we get
* here and AUDIT_BUFSIZ is at least 1024, then we can
@@ -746,9 +716,9 @@ static void audit_log_vformat(struct aud
avail = audit_expand(ab);
if (!avail)
goto out;
- len = vsnprintf(ab->tmp + ab->len, avail, fmt, args);
+ len = vsnprintf(skb->tail, avail, fmt, args);
}
- ab->len += (len < avail) ? len : avail;
+ skb_put(skb, (len < avail) ? len : avail);
out:
return;
}
@@ -796,21 +766,22 @@ void audit_log_d_path(struct audit_buffe
struct dentry *dentry, struct vfsmount *vfsmnt)
{
char *p;
+ struct sk_buff *skb = ab->skb;
int len, avail;
if (prefix)
audit_log_format(ab, " %s", prefix);
- avail = ab->size - ab->len;
- p = d_path(dentry, vfsmnt, ab->tmp + ab->len, avail);
+ avail = skb_tailroom(skb);
+ p = d_path(dentry, vfsmnt, skb->tail, avail);
if (IS_ERR(p)) {
/* FIXME: can we save some information here? */
audit_log_format(ab, "<toolong>");
} else {
- /* path isn't at start of buffer */
- len = (ab->tmp + ab->size - 1) - p;
- memmove(ab->tmp + ab->len, p, len);
- ab->len += len;
+ /* path isn't at start of buffer */
+ len = ((char *)skb->tail + avail - 1) - p;
+ memmove(skb->tail, p, len);
+ skb_put(skb, len);
}
}
@@ -861,7 +832,6 @@ static void audit_log_end_fast(struct au
if (!audit_rate_check()) {
audit_log_lost("rate limit exceeded");
} else {
- audit_log_move(ab);
if (audit_log_drain(ab))
return;
}
3:35 a.m.
New subject: [PATCH 3/3] buffer audit msgs directly to skb
On Fri, 2005-05-06 at 00:55 -0700, Chris Wright wrote:
Drop the use of a tmp buffer in the audit_buffer, and just buffer
directly to the skb. All header data that was temporarily stored in
the audit_buffer can now be stored directly in the netlink header in
the skb. Resize skb as needed. This eliminates the extra copy (and
the audit_log_move function which was responsible for copying).
Actually it doesn't, does it? We used to pass an optimally-sized skb
into netlink_unicast() but now we pass one that's larger than it needs
to be.... so netlink_trim() is going to trim it.
I'm going to look at cleaning up this code. Probably the answer will be
to revert to using the tmp buffer, and queue optimally-sized skbs for
netlink.
--
dwmw2
3:03 p.m.
New subject: [PATCH 2/3] expand audit tmp buffer as needed
On Friday 06 May 2005 03:54, Chris Wright wrote:
@@ -132,14 +132,11 @@ static DECLARE_MUTEX(audit_netlink_sem);
* use simultaneously. */
struct audit_buffer {
struct list_head list;
- struct sk_buff_head sklist; /* formatted skbs ready to send */
+ struct sk_buff *skb; /* formatted skb ready to send */
struct audit_context *ctx; /* NULL or associated context */
int len; /* used area of tmp */
- char tmp[AUDIT_BUFSIZ];
-
- /* Pointer to header and contents */
- struct nlmsghdr *nlh;
- int total;
+ int size; /* size of tmp */
+ char *tmp;
int type;
int pid;
};
I have a feeling this will impact all the parsers and the message type work
that I was just starting to do. The way I understand this patch, we will no
longer iterate in audit_log_drain spitting out separate messages for d_path
or anything else that gets added.
So what are we going to have for a separator between the audit context dump
and any supplemental information? Can you post a couple example records
(since we can't actually try out the netlink changes yet)?
I was planning to change audit_log_start to take a type parameter as well as
audit_log_format and put the type into the message.
-Steve
3:43 p.m.
New subject: [PATCH 2/3] expand audit tmp buffer as needed
* Steve Grubb (sgrubb(a)redhat.com) wrote:
On Friday 06 May 2005 03:54, Chris Wright wrote:
> @@ -132,14 +132,11 @@ static DECLARE_MUTEX(audit_netlink_sem);
> * use simultaneously. */
> struct audit_buffer {
> struct list_head list;
> - struct sk_buff_head sklist; /* formatted skbs ready to send */
> + struct sk_buff *skb; /* formatted skb ready to send */
> struct audit_context *ctx; /* NULL or associated context */
> int len; /* used area of tmp */
> - char tmp[AUDIT_BUFSIZ];
> -
> - /* Pointer to header and contents */
> - struct nlmsghdr *nlh;
> - int total;
> + int size; /* size of tmp */
> + char *tmp;
> int type;
> int pid;
> };
I have a feeling this will impact all the parsers and the message type work
that I was just starting to do. The way I understand this patch, we will no
longer iterate in audit_log_drain spitting out separate messages for d_path
or anything else that gets added.
There's only one skb now. All data is acutally in that skb. Userspace
does not handle (now) the multiple skb case anyway. It drops the
subsequent data.
So what are we going to have for a separator between the audit
context dump
and any supplemental information? Can you post a couple example records
(since we can't actually try out the netlink changes yet)?
Sure, here's some that went to syslog (I'll have to reboot to a working
kernel, and I'm still waiting for it to build this rpm kernel with some
debugging and the patch i sent).
May 6 00:33:18 vas kernel: audit(1115364505.576:1013290): item=0
name="/dev/null" inode=2035 dev=00:0e mode=020666 uid=0 gid=0 rdev=01:03
May 6 00:33:18 vas kernel: audit(1115364505.577:1013333): syscall=5 arch=40000003
success=yes exit=3 a0=a50fd9 a1=0 a2=0 a3=0 items=1 pid=15519 loginuid=-1 uid=23 gid=500
euid=23 suid=23 fsuid=23 egid=500 sgid=500 fsgid=500 comm=usleep exe=/bin/usleep
May 6 00:33:18 vas kernel: audit(1115364505.577:1013333): item=0
name="/etc/ld.so.cache" inode=84283 dev=03:03 mode=0100644 uid=0 gid=0
rdev=00:00
I was planning to change audit_log_start to take a type parameter as
well as
audit_log_format and put the type into the message.
I have that patch here already. In my next batch of cleanups. I'll
send them out as soon as I nail the current issue.
thanks,
-chris
--
Linux Security Modules http://lsm.immunix.org http://lsm.bkbits.net
3:58 p.m.
New subject: [PATCH 2/3] expand audit tmp buffer as needed
On Friday 06 May 2005 16:43, Chris Wright wrote:
Sure, here's some that went to syslog (I'll have to reboot to
a working
kernel, and I'm still waiting for it to build this rpm kernel with some
debugging and the patch i sent).
OK. This looks like its still the same. Parsers should still work.
-Steve
2:56 a.m.
* Chris Wright (chrisw(a)osdl.org) wrote:
1) audit-buffer-alloc.patch - adds simpler alloc/free helper
functions
2) audit-buffer-expand.patch - moves to a dynamic tmp buffer which can
be expanded as needed. copy message to a single skb.
3) audit-buffer-skb.patch - eliminate tmp buffer and write directly to skb.
BTW, these are against current audit git tree.
thanks,
-chris
10 a.m.
On Fri, 2005-05-06 at 00:56 -0700, Chris Wright wrote:
BTW, these are against current audit git tree.
Applied. Along with...
--- linux-2.6.9/kernel/audit.c~ 2005-05-06 15:55:59.000000000 +0100
+++ linux-2.6.9/kernel/audit.c 2005-05-06 15:56:32.000000000 +0100
@@ -626,13 +626,13 @@ static struct audit_buffer * audit_buffe
spin_unlock_irqrestore(&audit_freelist_lock, flags);
if (!ab) {
- ab = kmalloc(sizeof(*ab), GFP_ATOMIC);
+ ab = kmalloc(sizeof(*ab), gfp_mask);
if (!ab)
goto err;
}
atomic_inc(&audit_backlog);
- ab->skb = alloc_skb(AUDIT_BUFSIZ, GFP_ATOMIC);
+ ab->skb = alloc_skb(AUDIT_BUFSIZ, gfp_mask);
if (!ab->skb)
goto err;
--
dwmw2
7157
days inactive
7169
days old
linux-audit@lists.linux-audit.osci.io
10 comments
3 participants
participants (3)
-
Chris Wright -
David Woodhouse -
Steve Grubb