Re: [PATCH RFC 2/4] audit: compact name entries and context fields

[Paul Moore <paul@paul-moore.com>]

On Sep 17, 2026 =?UTF-8?q?Christian=20G=C3=B6ttsche?= <cgoettsche@seltendoof.de> wrote:
> 
> Group aligned name fields and small scalar fields to remove padding. Keep
> file capabilities last so they do not separate inode and pathname metadata.
> Store the per-name file capability revision in s16: it must represent both
> the eight-bit on-disk revision and the -1 AUDIT_INODE_NOEVAL sentinel. Keep
> the existing formatter and its unknown-capability output unchanged.
> 
> Move name_count beside return_valid to remove two alignment holes, and
> place personality before the task credential scalars. Preserve the first
> int dummy member required by audit_dummy_context(), all five embedded name
> slots, and the existing allocation and reference lifetimes.
> 
> On x86_64 with SELinux this reduces audit_context from 928 to 880 bytes,
> leaving room for descriptor paths while staying below 1 KiB. On the tested
> arm64 configuration without property-bearing LSMs it falls to 872 bytes.
> 
> Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
> ---
>  kernel/audit.h | 17 ++++++++---------
>  1 file changed, 8 insertions(+), 9 deletions(-)
> 
> diff --git a/kernel/audit.h b/kernel/audit.h
> index 7640d2c0fba4..bd798f8553a0 100644
> --- a/kernel/audit.h
> +++ b/kernel/audit.h
> @@ -76,18 +76,16 @@ struct audit_names {
>  	struct list_head	list;		/* audit_context->names_list */
>  
>  	struct filename		*name;
> -	int			name_len;	/* number of chars to log */
> -	bool			hidden;		/* don't log this record */
> -
>  	u64			ino;
> +	struct lsm_prop		oprop;
>  	dev_t			dev;
> -	umode_t			mode;
>  	kuid_t			uid;
>  	kgid_t			gid;
>  	dev_t			rdev;
> -	struct lsm_prop		oprop;
> -	struct audit_file_caps	fcap;
> -	unsigned int		fcap_ver;
> +	int			name_len;	/* number of chars to log */
> +	s16			fcap_ver;	/* 8-bit revision, or -1 for NOEVAL */

Should we also change the fcap_ver in audit_aux_data_bprm_fcaps?

> +	umode_t			mode;
> +	bool			hidden;		/* don't log this record */
>  	unsigned char		type;		/* record type */
>  	/*
>  	 * This was an allocated audit_names and not from the array of
> @@ -95,6 +93,7 @@ struct audit_names {
>  	 * should be freed on syscall exit.
>  	 */
>  	bool			should_free;
> +	struct audit_file_caps	fcap;
>  };

I understand why you moved the fields as you did, but is there any way
we can keep name adjacent to name_len and fcap adjacent to fcap_ver?
Splitting them makes the structure layout awkward to read.

You would need to check that this is safe, but if it helps we could
probably change name_len to a shorter type as PATH_MAX is only 4k and
that limit is part of the UAPI so it isn't easily changed.

>  struct audit_proctitle {
> @@ -124,6 +123,7 @@ struct audit_context {
>  	long		    return_code;/* syscall return code */
>  	u64		    prio;
>  	int		    return_valid; /* return code is valid */
> +	int		    name_count; /* total records in names_list */

I think it would look better to move this below the comment that is
directly below it so it remains adjacent to audit_names.  This shouldn't
affect the struct padding/packing.

>  	/*
>  	 * The names_list is the list of all audit_names collected during this
>  	 * syscall.  The first AUDIT_NAMES entries in the names_list will
> @@ -133,7 +133,6 @@ struct audit_context {
>  	 * by running the names_list.
>  	 */
>  	struct audit_names  preallocated_names[AUDIT_NAMES];
> -	int		    name_count; /* total records in names_list */
>  	struct list_head    names_list;	/* struct audit_names->list anchor */
>  	char		    *filterkey;	/* key for rule that triggered record */
>  	struct path	    pwd;
> @@ -142,10 +141,10 @@ struct audit_context {
>  	struct sockaddr_storage *sockaddr;
>  	size_t sockaddr_len;
>  	/* Save things to print about task_struct */
> +	unsigned long	    personality;
>  	pid_t		    ppid;
>  	kuid_t		    uid, euid, suid, fsuid;
>  	kgid_t		    gid, egid, sgid, fsgid;
> -	unsigned long	    personality;
>  	int		    arch;
>  
>  	pid_t		    target_pid;
> -- 
> 2.55.0

--
paul-moore.com