From mboxrd@z Thu Jan 1 00:00:00 1970 From: Richard Guy Briggs Subject: Re: [PATCH 2/2] audit: don't reset working wait time accidentally with auditd Date: Fri, 30 Jan 2015 16:10:44 -0500 Message-ID: <20150130211044.GY18752@madcap2.tricolour.ca> References: <2192ffc51189b5caa7d7172d59fea6fcc8bf07a5.1422392773.git.rgb@redhat.com> <075a355dd6d63a0330ffc5ef5a3480132540827b.1422392773.git.rgb@redhat.com> <4410568.1yJqvi4AlT@sifl> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Content-Disposition: inline In-Reply-To: <4410568.1yJqvi4AlT@sifl> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Paul Moore Cc: linux-audit@redhat.com, eparis@parisplace.org List-Id: linux-audit@redhat.com On 15/01/29, Paul Moore wrote: > On Tuesday, January 27, 2015 07:34:02 PM Richard Guy Briggs wrote: > > During a queue overflow condition while we are waiting for auditd to drain > > the queue to make room for regular messages, we don't want a successful > > auditd that has bypassed the queue check to reset the backlog wait time. > > > > Signed-off-by: Richard Guy Briggs > > --- > > kernel/audit.c | 3 ++- > > 1 files changed, 2 insertions(+), 1 deletions(-) > > I'm still wondering why we ever change audit_backlog_wait_time, it is only so > we don't end up calling wait_for_auditd() multiple times while we are waiting > for the queue to drain? Not exactly. Up to the timeout, all subsequent callers will wait for auditd as well. It is so that if wait_for_auditd() does time out, we don't make new callers after that timeout wait, but return an error immediately. If/when auditd does manage to succeed and recover after that wait time, it will reset the wait time and resume normal operation. > As a general comment, not directed at anyone in particular, the audit > backlog/queue handling looks a little odd ... Indeed... > > diff --git a/kernel/audit.c b/kernel/audit.c > > index b333f03..73293ea 100644 > > --- a/kernel/audit.c > > +++ b/kernel/audit.c > > @@ -1395,7 +1395,8 @@ struct audit_buffer *audit_log_start(struct > > audit_context *ctx, gfp_t gfp_mask, return NULL; > > } > > > > - audit_backlog_wait_time = audit_backlog_wait_time_master; > > + if (!reserve) > > + audit_backlog_wait_time = audit_backlog_wait_time_master; > > > > ab = audit_buffer_alloc(ctx, gfp_mask, type); > > if (!ab) { > > -- > paul moore - RGB -- Richard Guy Briggs Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, Red Hat Remote, Ottawa, Canada Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545