Re: audit_reusename in getname_flags

Re: audit_reusename in getname_flags

[Jeff Layton]

On Thu, 2025-02-06 at 20:07 +0100, Mateusz Guzik wrote:
> You added it in:
> commit 7ac86265dc8f665cc49d6e60a125e608cd2fca14
> Author: Jeff Layton <jlayton@kernel.org>
> Date:   Wed Oct 10 15:25:28 2012 -0400
> 
>     audit: allow audit code to satisfy getname requests from its names_list
> 
> Do I read correctly this has no user-visible impact, but merely tries
> to shave off some memory usage in case of duplicated user bufs?
> 
> This is partially getting in the way of whacking atomics for filename
> ref management (but can be worked around).
> 
> AFAIU this change is not all *that* beneficial in its own right, so
> should not be a big deal to whack it regardless of what happens with
> refs? Note it would also remove some branches in the common case as
> normally audit either has dummy context or there is no match anyway.


(cc'ing audit folks and mailing list)

IIRC, having duplicate audit_names records can cause audit to emit
extra name records in this loop in audit_log_exit():

        list_for_each_entry(n, &context->names_list, list) { 
                if (n->hidden)
                        continue;
                audit_log_name(context, n, NULL, i++, &call_panic);
        }


...which is something you probably want to avoid.
-- 
Jeff Layton <jlayton@kernel.org>

Re: audit_reusename in getname_flags

[Mateusz Guzik]

On Thu, Feb 6, 2025 at 9:24 PM Jeff Layton <jlayton@kernel.org> wrote:
>
> On Thu, 2025-02-06 at 20:07 +0100, Mateusz Guzik wrote:
> > You added it in:
> > commit 7ac86265dc8f665cc49d6e60a125e608cd2fca14
> > Author: Jeff Layton <jlayton@kernel.org>
> > Date:   Wed Oct 10 15:25:28 2012 -0400
> >
> >     audit: allow audit code to satisfy getname requests from its names_list
> >
> > Do I read correctly this has no user-visible impact, but merely tries
> > to shave off some memory usage in case of duplicated user bufs?
> >
> > This is partially getting in the way of whacking atomics for filename
> > ref management (but can be worked around).
> >
> > AFAIU this change is not all *that* beneficial in its own right, so
> > should not be a big deal to whack it regardless of what happens with
> > refs? Note it would also remove some branches in the common case as
> > normally audit either has dummy context or there is no match anyway.
>
>
> (cc'ing audit folks and mailing list)
>
> IIRC, having duplicate audit_names records can cause audit to emit
> extra name records in this loop in audit_log_exit():
>
>         list_for_each_entry(n, &context->names_list, list) {
>                 if (n->hidden)
>                         continue;
>                 audit_log_name(context, n, NULL, i++, &call_panic);
>         }
>
>
> ...which is something you probably want to avoid.

Well in this case I would argue the current code is buggy, unless I'm
misunderstanding something.

audit_log_name in particular logs:
  1550 │       if (n->ino != AUDIT_INO_UNSET)
  1551 │               audit_log_format(ab, " inode=%lu dev=%02x:%02x
mode=%#ho ouid=%u ogid=%u rdev=%02x
  1552 │                                n->ino,
  1553 │                                MAJOR(n->dev),
  1554 │                                MINOR(n->dev),
  1555 │                                n->mode,
  1556 │                                from_kuid(&init_user_ns, n->uid),
  1557 │                                from_kgid(&init_user_ns, n->gid),
  1558 │                                MAJOR(n->rdev),
  1559 │                                MINOR(n->rdev));

As in it grabs the properties of the found inode.

Suppose the 2 lookups of the same path name found 2 different inodes
as someone was mucking with the filesystem at the same time.

Then this is going to *fail* to record the next inode.

So if any dedup is necessary, it should be done by audit when logging imo.

-- 
Mateusz Guzik <mjguzik gmail.com>

Re: audit_reusename in getname_flags

[Mateusz Guzik]

On Thu, Feb 6, 2025 at 9:34 PM Mateusz Guzik <mjguzik@gmail.com> wrote:
>
> On Thu, Feb 6, 2025 at 9:24 PM Jeff Layton <jlayton@kernel.org> wrote:
> >
> > On Thu, 2025-02-06 at 20:07 +0100, Mateusz Guzik wrote:
> > > You added it in:
> > > commit 7ac86265dc8f665cc49d6e60a125e608cd2fca14
> > > Author: Jeff Layton <jlayton@kernel.org>
> > > Date:   Wed Oct 10 15:25:28 2012 -0400
> > >
> > >     audit: allow audit code to satisfy getname requests from its names_list
> > >
> > > Do I read correctly this has no user-visible impact, but merely tries
> > > to shave off some memory usage in case of duplicated user bufs?
> > >
> > > This is partially getting in the way of whacking atomics for filename
> > > ref management (but can be worked around).
> > >
> > > AFAIU this change is not all *that* beneficial in its own right, so
> > > should not be a big deal to whack it regardless of what happens with
> > > refs? Note it would also remove some branches in the common case as
> > > normally audit either has dummy context or there is no match anyway.
> >
> >
> > (cc'ing audit folks and mailing list)
> >
> > IIRC, having duplicate audit_names records can cause audit to emit
> > extra name records in this loop in audit_log_exit():
> >
> >         list_for_each_entry(n, &context->names_list, list) {
> >                 if (n->hidden)
> >                         continue;
> >                 audit_log_name(context, n, NULL, i++, &call_panic);
> >         }
> >
> >
> > ...which is something you probably want to avoid.
>
> Well in this case I would argue the current code is buggy, unless I'm
> misunderstanding something.
>
> audit_log_name in particular logs:
>   1550 │       if (n->ino != AUDIT_INO_UNSET)
>   1551 │               audit_log_format(ab, " inode=%lu dev=%02x:%02x
> mode=%#ho ouid=%u ogid=%u rdev=%02x
>   1552 │                                n->ino,
>   1553 │                                MAJOR(n->dev),
>   1554 │                                MINOR(n->dev),
>   1555 │                                n->mode,
>   1556 │                                from_kuid(&init_user_ns, n->uid),
>   1557 │                                from_kgid(&init_user_ns, n->gid),
>   1558 │                                MAJOR(n->rdev),
>   1559 │                                MINOR(n->rdev));
>
> As in it grabs the properties of the found inode.
>
> Suppose the 2 lookups of the same path name found 2 different inodes
> as someone was mucking with the filesystem at the same time.
>
> Then this is going to *fail* to record the next inode.
>
> So if any dedup is necessary, it should be done by audit when logging imo.
>

I did more digging, audit indeed *does* handle it later in
__audit_inode(), so this does work after all.

I'm going to have to chew on it what to do here then.

-- 
Mateusz Guzik <mjguzik gmail.com>