audit_reusename in getname_flags

audit_reusename in getname_flags

[Mateusz Guzik]

You added it in:
commit 7ac86265dc8f665cc49d6e60a125e608cd2fca14
Author: Jeff Layton <jlayton@kernel.org>
Date:   Wed Oct 10 15:25:28 2012 -0400

    audit: allow audit code to satisfy getname requests from its names_list

Do I read correctly this has no user-visible impact, but merely tries
to shave off some memory usage in case of duplicated user bufs?

This is partially getting in the way of whacking atomics for filename
ref management (but can be worked around).

AFAIU this change is not all *that* beneficial in its own right, so
should not be a big deal to whack it regardless of what happens with
refs? Note it would also remove some branches in the common case as
normally audit either has dummy context or there is no match anyway.

-- 
Mateusz Guzik <mjguzik gmail.com>

Re: audit_reusename in getname_flags

[Jeff Layton]

On Thu, 2025-02-06 at 20:07 +0100, Mateusz Guzik wrote:
> You added it in:
> commit 7ac86265dc8f665cc49d6e60a125e608cd2fca14
> Author: Jeff Layton <jlayton@kernel.org>
> Date:   Wed Oct 10 15:25:28 2012 -0400
> 
>     audit: allow audit code to satisfy getname requests from its names_list
> 
> Do I read correctly this has no user-visible impact, but merely tries
> to shave off some memory usage in case of duplicated user bufs?
> 
> This is partially getting in the way of whacking atomics for filename
> ref management (but can be worked around).
> 
> AFAIU this change is not all *that* beneficial in its own right, so
> should not be a big deal to whack it regardless of what happens with
> refs? Note it would also remove some branches in the common case as
> normally audit either has dummy context or there is no match anyway.


(cc'ing audit folks and mailing list)

IIRC, having duplicate audit_names records can cause audit to emit
extra name records in this loop in audit_log_exit():

        list_for_each_entry(n, &context->names_list, list) { 
                if (n->hidden)
                        continue;
                audit_log_name(context, n, NULL, i++, &call_panic);
        }


...which is something you probably want to avoid.
-- 
Jeff Layton <jlayton@kernel.org>

Re: audit_reusename in getname_flags

[Mateusz Guzik]

On Thu, Feb 6, 2025 at 9:24 PM Jeff Layton <jlayton@kernel.org> wrote:
>
> On Thu, 2025-02-06 at 20:07 +0100, Mateusz Guzik wrote:
> > You added it in:
> > commit 7ac86265dc8f665cc49d6e60a125e608cd2fca14
> > Author: Jeff Layton <jlayton@kernel.org>
> > Date:   Wed Oct 10 15:25:28 2012 -0400
> >
> >     audit: allow audit code to satisfy getname requests from its names_list
> >
> > Do I read correctly this has no user-visible impact, but merely tries
> > to shave off some memory usage in case of duplicated user bufs?
> >
> > This is partially getting in the way of whacking atomics for filename
> > ref management (but can be worked around).
> >
> > AFAIU this change is not all *that* beneficial in its own right, so
> > should not be a big deal to whack it regardless of what happens with
> > refs? Note it would also remove some branches in the common case as
> > normally audit either has dummy context or there is no match anyway.
>
>
> (cc'ing audit folks and mailing list)
>
> IIRC, having duplicate audit_names records can cause audit to emit
> extra name records in this loop in audit_log_exit():
>
>         list_for_each_entry(n, &context->names_list, list) {
>                 if (n->hidden)
>                         continue;
>                 audit_log_name(context, n, NULL, i++, &call_panic);
>         }
>
>
> ...which is something you probably want to avoid.

Well in this case I would argue the current code is buggy, unless I'm
misunderstanding something.

audit_log_name in particular logs:
  1550 │       if (n->ino != AUDIT_INO_UNSET)
  1551 │               audit_log_format(ab, " inode=%lu dev=%02x:%02x
mode=%#ho ouid=%u ogid=%u rdev=%02x
  1552 │                                n->ino,
  1553 │                                MAJOR(n->dev),
  1554 │                                MINOR(n->dev),
  1555 │                                n->mode,
  1556 │                                from_kuid(&init_user_ns, n->uid),
  1557 │                                from_kgid(&init_user_ns, n->gid),
  1558 │                                MAJOR(n->rdev),
  1559 │                                MINOR(n->rdev));

As in it grabs the properties of the found inode.

Suppose the 2 lookups of the same path name found 2 different inodes
as someone was mucking with the filesystem at the same time.

Then this is going to *fail* to record the next inode.

So if any dedup is necessary, it should be done by audit when logging imo.

-- 
Mateusz Guzik <mjguzik gmail.com>

Re: audit_reusename in getname_flags

[Mateusz Guzik]

On Thu, Feb 6, 2025 at 9:34 PM Mateusz Guzik <mjguzik@gmail.com> wrote:
>
> On Thu, Feb 6, 2025 at 9:24 PM Jeff Layton <jlayton@kernel.org> wrote:
> >
> > On Thu, 2025-02-06 at 20:07 +0100, Mateusz Guzik wrote:
> > > You added it in:
> > > commit 7ac86265dc8f665cc49d6e60a125e608cd2fca14
> > > Author: Jeff Layton <jlayton@kernel.org>
> > > Date:   Wed Oct 10 15:25:28 2012 -0400
> > >
> > >     audit: allow audit code to satisfy getname requests from its names_list
> > >
> > > Do I read correctly this has no user-visible impact, but merely tries
> > > to shave off some memory usage in case of duplicated user bufs?
> > >
> > > This is partially getting in the way of whacking atomics for filename
> > > ref management (but can be worked around).
> > >
> > > AFAIU this change is not all *that* beneficial in its own right, so
> > > should not be a big deal to whack it regardless of what happens with
> > > refs? Note it would also remove some branches in the common case as
> > > normally audit either has dummy context or there is no match anyway.
> >
> >
> > (cc'ing audit folks and mailing list)
> >
> > IIRC, having duplicate audit_names records can cause audit to emit
> > extra name records in this loop in audit_log_exit():
> >
> >         list_for_each_entry(n, &context->names_list, list) {
> >                 if (n->hidden)
> >                         continue;
> >                 audit_log_name(context, n, NULL, i++, &call_panic);
> >         }
> >
> >
> > ...which is something you probably want to avoid.
>
> Well in this case I would argue the current code is buggy, unless I'm
> misunderstanding something.
>
> audit_log_name in particular logs:
>   1550 │       if (n->ino != AUDIT_INO_UNSET)
>   1551 │               audit_log_format(ab, " inode=%lu dev=%02x:%02x
> mode=%#ho ouid=%u ogid=%u rdev=%02x
>   1552 │                                n->ino,
>   1553 │                                MAJOR(n->dev),
>   1554 │                                MINOR(n->dev),
>   1555 │                                n->mode,
>   1556 │                                from_kuid(&init_user_ns, n->uid),
>   1557 │                                from_kgid(&init_user_ns, n->gid),
>   1558 │                                MAJOR(n->rdev),
>   1559 │                                MINOR(n->rdev));
>
> As in it grabs the properties of the found inode.
>
> Suppose the 2 lookups of the same path name found 2 different inodes
> as someone was mucking with the filesystem at the same time.
>
> Then this is going to *fail* to record the next inode.
>
> So if any dedup is necessary, it should be done by audit when logging imo.
>

I did more digging, audit indeed *does* handle it later in
__audit_inode(), so this does work after all.

I'm going to have to chew on it what to do here then.

-- 
Mateusz Guzik <mjguzik gmail.com>