From mboxrd@z Thu Jan 1 00:00:00 1970 From: Peter Hurley Subject: Re: [PATCH 00/15] Rework tty audit Date: Thu, 12 Nov 2015 21:31:17 -0500 Message-ID: <56454B75.6060901@hurleysoftware.com> References: <1447207560-16410-1-git-send-email-peter@hurleysoftware.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from mx1.redhat.com (ext-mx01.extmail.prod.ext.phx2.redhat.com [10.5.110.25]) by int-mx11.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id tAD2VLIv007976 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO) for ; Thu, 12 Nov 2015 21:31:21 -0500 Received: from mail-io0-f171.google.com (mail-io0-f171.google.com [209.85.223.171]) by mx1.redhat.com (Postfix) with ESMTPS id 1C7D7A0B40 for ; Fri, 13 Nov 2015 02:31:20 +0000 (UTC) Received: by ioir85 with SMTP id r85so44301348ioi.1 for ; Thu, 12 Nov 2015 18:31:19 -0800 (PST) In-Reply-To: <1447207560-16410-1-git-send-email-peter@hurleysoftware.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Greg Kroah-Hartman Cc: Peter Zijlstra , Oleg Nesterov , Richard Guy Briggs , linux-audit@redhat.com, Jiri Slaby , Ingo Molnar List-Id: linux-audit@redhat.com On 11/10/2015 09:05 PM, Peter Hurley wrote: > Hi Greg, > > This patch series overhauls tty audit support. The goal was to simplify > and speed up tty auditing, which was a significant performance hit even > when disabled. > > The main features of this series are: > * Remove reference counting; the purpose of reference counting the per- > process tty_audit_buf was to prevent premature deletion if the > buffer was in-use when tty auditing was exited for the process. > However, since the process is single-threaded at tty_audit_exit(), > the buffer cannot be in-use by another thread. Patch 11/15. > * Remove functionally dead code, such as tty_put_user(). Patch 2/15. > * Atomically modify tty audit enable/disable flags to support lockless > read. Patch 9/15. > > Cc: Ingo Molnar > Cc: Peter Zijlstra > for patch 9/15 which removes an audit field from the signal_struct. > > Cc: Oleg Nesterov > to confirm my understanding of the single-threadedness of > if (group_dead) tty_audit_exit(), called from do_exit(). Patch 11/15 > > Requires: "tty: audit: Fix audit source" and as brought to my attention by Richard Guy Briggs also Requires: "n_tty: Uninline tty_copy_to_user()" Apologies for any inconvenience caused. > Regards, > > Peter Hurley (15): > tty: audit: Early-out pty master reads earlier > tty: audit: Never audit packet mode > tty: audit: Remove icanon mode from call chain > tty: audit: Defer audit buffer association > tty: audit: Take siglock directly > tty: audit: Ignore current association for audit push > tty: audit: Combine push functions > tty: audit: Track tty association with dev_t > tty: audit: Handle tty audit enable atomically > tty: audit: Remove false memory optimization > tty: audit: Remove tty_audit_buf reference counting > tty: audit: Simplify first-use allocation > tty: audit: Check audit enable first > tty: audit: Always push audit buffer before TIOCSTI > tty: audit: Poison tty_audit_buf while process exits > > drivers/tty/n_tty.c | 25 ++---- > drivers/tty/tty_audit.c | 231 ++++++++++++++---------------------------------- > include/linux/audit.h | 4 + > include/linux/sched.h | 1 - > include/linux/tty.h | 12 +-- > kernel/audit.c | 27 +++--- > 6 files changed, 97 insertions(+), 203 deletions(-) >