From mboxrd@z Thu Jan 1 00:00:00 1970 From: Richard Guy Briggs Subject: Re: [PATCH V2] audit: log 32-bit socketcalls Date: Fri, 13 Jan 2017 10:20:48 -0500 Message-ID: <20170113152047.GC3087@madcap2.tricolour.ca> References: <1484318543.5300.1.camel@redhat.com> <20170113150637.GB3087@madcap2.tricolour.ca> <1484320702.5300.8.camel@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: 8bit Return-path: Content-Disposition: inline In-Reply-To: <1484320702.5300.8.camel@redhat.com> Sender: netdev-owner@vger.kernel.org To: Eric Paris Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org, linux-audit@redhat.com, Kangkook Jee , Paul Moore , Steve Grubb List-Id: linux-audit@redhat.com On 2017-01-13 10:18, Eric Paris wrote: > On Fri, 2017-01-13 at 10:06 -0500, Richard Guy Briggs wrote: > > On 2017-01-13 09:42, Eric Paris wrote: > > > On Fri, 2017-01-13 at 04:51 -0500, Richard Guy Briggs wrote: > > > > > > diff --git a/include/linux/audit.h b/include/linux/audit.h > > > > index 9d4443f..43d8003 100644 > > > > --- a/include/linux/audit.h > > > > +++ b/include/linux/audit.h > > > > @@ -387,6 +387,18 @@ static inline int audit_socketcall(int > > > > nargs, > > > > unsigned long *args) > > > >   return __audit_socketcall(nargs, args); > > > >   return 0; > > > >  } > > > > +static inline int audit_socketcall_compat(int nargs, u32 *args) > > > > +{ > > > > + if (unlikely(!audit_dummy_context())) { > > > > > > I've always hated these likely/unlikely. Mostly because I think > > > they > > > are so often wrong. I believe this says that you compiled audit in > > > but > > > you expect it to be explicitly disabled. While that is (recently) > > > true > > > in Fedora I highly doubt that's true on the vast majority of > > > systems > > > that have audit compiled in. > > > > It has been argued that audit should have pretty much no performance > > impact if it is not in use and that if it is, we're willing to take > > the > > more significant overhead of the rest of the code for the sake of one > > test to determine whether or not to follow this code path. > > Ok, I can buy that argument. Not sure its where I would have settled, > but it does make sense. I'll obviously defer to Paul on what he wants > out of style. I always assume the compiler is brilliant and write > stupid code but your logic is sound there too. > > You can/should pretend I said nothing. You're keeping me honest and making me work for my dinner! ;-) - RGB