Re: [RFC PATCH 3/7] audit: allow systemd to use queue reserves

From: Paul Moore <paul@paul-moore.com>
To: Richard Guy Briggs <rgb@redhat.com>
Cc: linux-audit@redhat.com
Subject: Re: [RFC PATCH 3/7] audit: allow systemd to use queue reserves
Date: Thu, 05 Nov 2015 17:38:40 -0500	[thread overview]
Message-ID: <1945739.qBIBrYXbVh@sifl> (raw)
In-Reply-To: <20151022195159.GD16212@madcap2.tricolour.ca>

On Thursday, October 22, 2015 03:51:59 PM Richard Guy Briggs wrote:
> On 15/10/22, Steve Grubb wrote:
> > On Thursday, October 22, 2015 02:53:16 PM Richard Guy Briggs wrote:
> > > Treat systemd the same way as auditd, allowing it to overrun the queue
> > > to avoid blocking.
> > 
> > Do you mind explaining this a little more? I'm having a hard time
> > understanding how systemd is involved.
> 
> systemd should only have CAP_AUDIT_READ for the multicast socket and
> otherwise behaves as a user client, sending AUDIT_USER_* messages.  It
> starts and stops auditd and we don't want it blocking trying to allocate
> a buffer on the standard queue in audit_log_start() while it is tasked
> with telling auditd to start or stop.

Is this something we are hearing reports about?  Starting and stopping auditd 
should be rare in normal use, and by rare I mean start it at boot and don't 
touch it again ... although I suspect you might update/patch it at some point 
if your system is long running.

If this is a common problem we can look at doing something like this, but if 
it isn't - and I don't think it is - I'd like to avoid special casing init 
(it's even more specialized since we are basically talking about just systemd, 
although others could have similar problems).

> > -Steve
> > 
> > > Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
> > > ---
> > > 
> > >  kernel/audit.c |    2 +-
> > >  1 files changed, 1 insertions(+), 1 deletions(-)
> > > 
> > > diff --git a/kernel/audit.c b/kernel/audit.c
> > > index 3917aad..384a1a1 100644
> > > --- a/kernel/audit.c
> > > +++ b/kernel/audit.c
> > > @@ -1375,7 +1375,7 @@ struct audit_buffer *audit_log_start(struct
> > > audit_context *ctx, gfp_t gfp_mask, return NULL;
> > > 
> > >  	if (gfp_mask & __GFP_WAIT) {
> > > 
> > > -		if (audit_pid && audit_pid == current->tgid)
> > > +		if (current->tgid == 1 || (audit_pid && audit_pid == current-
>tgid))
> > > 
> > >  			gfp_mask &= ~__GFP_WAIT;
> > >  		
> > >  		else
> > >  		
> > >  			reserve = 0;
> 
> - RGB
> 
> --
> Richard Guy Briggs <rbriggs@redhat.com>
> Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems,
> Red Hat Remote, Ottawa, Canada
> Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545
> 
> --
> Linux-audit mailing list
> Linux-audit@redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit

-- 
paul moore
www.paul-moore.com