Re: [PATCH RFC 1/4] audit: separate file and process capability storage

[Paul Moore <paul@paul-moore.com>]

On Sep 17, 2026 =?UTF-8?q?Christian=20G=C3=B6ttsche?= <cgoettsche@seltendoof.de> wrote:
> 
> File capabilities need permitted and inheritable sets, an effective flag,
> and a root UID. Process capabilities need four full capability sets but
> neither a file effective flag nor a root UID. Give file capabilities their
> own type instead of storing both representations in audit_cap_data.
> 
> This reduces each preallocated audit_names entry by 16 bytes on the tested
> 64-bit configurations, saving 80 bytes per audit context. The BPRM
> capability auxiliary object also shrinks from 144 to 112 bytes. Retain all
> logged fields, including file root IDs and process ambient capabilities;
> record formats and collection behavior are unchanged.
> 
> Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
> ---
>  kernel/audit.h   | 15 +++++++++------
>  kernel/auditsc.c |  2 +-
>  2 files changed, 10 insertions(+), 7 deletions(-)

Nice :)

Merged into audit/dev, thanks!

--
paul-moore.com