From mboxrd@z Thu Jan  1 00:00:00 1970
From: Dustin Kirkland <dustin.kirkland@us.ibm.com>
Subject: Re: [PATCH] Replacement of IPC char* context to sid for improved
	performance
Date: Fri, 31 Mar 2006 09:16:52 -0600
Message-ID: <1143818212.18236.6.camel@localhost.localdomain>
References: <1143777716.31922.92.camel@localhost.localdomain>
	<1143785464.6328.18.camel@localhost.localdomain>
	<200603310828.13900.sgrubb@redhat.com>
Reply-To: Dustin Kirkland <dustin.kirkland@us.ibm.com>
Mime-Version: 1.0
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
In-Reply-To: <200603310828.13900.sgrubb@redhat.com>
List-Unsubscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: Steve Grubb <sgrubb@redhat.com>
Cc: Linux Audit Discussion <linux-audit@redhat.com>
List-Id: linux-audit@redhat.com

On Fri, 2006-03-31 at 08:28 -0500, Steve Grubb wrote:
> On Friday 31 March 2006 01:11, Dustin Kirkland wrote:
> > Steve, if you could (a) take a close look at this patch and ensure that
> > I'm closely following your model, and (b) build this patch and run
> > similar performance benchmarks, that would be great.  I'm traveling
> > tomorrow and will be out of pocket for the next few days.
> 
> I needed a patch to do this yesterday and created a patch I was going to send 
> out this morning. It is nearly identical to your patch, but I think you 
> eliminated a function that I missed. I'll reconcile the differences and post 
> a patch in a few minutes.
> 
> The only other item left is to find a test case to performance test with.


Here's a very basic one that I've used.  It only hits one ipc call, but
it does trigger the audit hooks in msgsnd

# gcc -o test_msgget test_msgget.c
# auditctl -a exit,always -S ipc
# tail /var/log/audit/audit.log



#include <sys/types.h>
#include <sys/ipc.h>
#include <sys/msg.h>
#include <sys/errno.h>
#include <sys/stat.h>
#include <stdio.h>

int main() {

	int rc = 0;
	int msgid = 0;
	int mode;

	mode = S_IRWXU;
	if( ( msgid = msgget( IPC_PRIVATE, mode ) ) == -1 ) {
		printf("ERROR: Unable to allocate new message queue: errno=%i\n", errno );
		goto EXIT;
	}

	if( ( rc = msgctl( msgid, IPC_RMID, 0 ) ) == -1 ) {
		printf( "Error removing message queue with ID = [%d]: errno = [%i]\n", msgid, errno );
		goto EXIT;
	}

EXIT:
	return rc;
}






--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit