From mboxrd@z Thu Jan 1 00:00:00 1970 From: Paul Moore Subject: Re: [PATCH] ratelimit printk messages from the audit system Date: Thu, 24 Jan 2008 13:08:48 -0500 Message-ID: <200801241308.48709.paul.moore@hp.com> References: <1201117808.3295.20.camel@localhost.localdomain> <200801241252.59996.paul.moore@hp.com> <1201197672.3256.7.camel@localhost.localdomain> Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <1201197672.3256.7.camel@localhost.localdomain> Content-Disposition: inline List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Eric Paris Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Thursday 24 January 2008 1:01:12 pm Eric Paris wrote: > On Thu, 2008-01-24 at 12:52 -0500, Paul Moore wrote: > > On Wednesday 23 January 2008 5:06:53 pm Linda Knippers wrote: > > > Eric Paris wrote: > > > > On Wed, 2008-01-23 at 16:05 -0500, Linda Knippers wrote: > > > >> This is unrelated to your patch but I think it would be nice > > > >> if audit_lost represented the number of audit messages lost > > > >> since the last time the message came out or the last time an > > > >> audit record came out. Today its a cumulative count since the > > > >> system was booted. Is it too much overhead to zero it? > > > > > > > > Shouldn't be too much overhead, we are already on a > > > > slow/unlikely path. What's the benefit though? Just don't want > > > > to have to do a subtraction? > > > > > > Well that, plus if the system is up for a long time (which we > > > hope) and the message is infrequent (which we also hope), then it > > > could take me a while to find the previous message in order to do > > > the subtraction. > > > > > > > If we are dropping the 'we lost some messages' message 0'ing > > > > the counter at that time would be a bad idea, certainly not > > > > unsolvable, but I don't see what it buys us. > > > > > > I wouldn't want to lose the message, just make it more useful. > > > And if we zero it we don't have to worry about it wrapping. As > > > it is now, its really just the count since the last time it > > > wrapped. > > > > I like Linda's idea of zero'ing the lost message counter once we > > are able to start sending messages again for all the reasons listed > > above. I haven't looked at the audit message sending code, but we > > are only talking about adding an extra conditional in the common > > case and in the worst case a conditional and an assignment. > > Granted they are atomic ops, but everyone keeps telling me that > > atomic ops are pretty quick on almost all of the platforms that > > Linux supports ... > > Delivery of audit lost messages is through printk/syslog. Assuming > we can assure it gets out of printk when we reset the counter we > can't assure that it made it to syslog. That means we could lose > that message and have no record of it at all, nor any chance that in > the future it would get recorded that it was lost either. That sort of begs the question - why do we even bother printing the audit record lost message? :) > I wouldn't NAK such a patch, but at the same time don't anyone expect > me to write it :) ... everytime I open my mouth I end up with more work ... -- paul moore linux security @ hp