From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751929AbdAMPSv (ORCPT ); Fri, 13 Jan 2017 10:18:51 -0500 Received: from mx1.redhat.com ([209.132.183.28]:39482 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751745AbdAMPSt (ORCPT ); Fri, 13 Jan 2017 10:18:49 -0500 Message-ID: <1484320702.5300.8.camel@redhat.com> Subject: Re: [PATCH V2] audit: log 32-bit socketcalls From: Eric Paris To: Richard Guy Briggs Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org, linux-audit@redhat.com, Kangkook Jee , Paul Moore , Steve Grubb Date: Fri, 13 Jan 2017 10:18:22 -0500 In-Reply-To: <20170113150637.GB3087@madcap2.tricolour.ca> References: <1484318543.5300.1.camel@redhat.com> <20170113150637.GB3087@madcap2.tricolour.ca> Content-Type: text/plain; charset="UTF-8" Mime-Version: 1.0 Content-Transfer-Encoding: 8bit X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.31]); Fri, 13 Jan 2017 15:18:25 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Fri, 2017-01-13 at 10:06 -0500, Richard Guy Briggs wrote: > On 2017-01-13 09:42, Eric Paris wrote: > > On Fri, 2017-01-13 at 04:51 -0500, Richard Guy Briggs wrote: > > > diff --git a/include/linux/audit.h b/include/linux/audit.h > > > index 9d4443f..43d8003 100644 > > > --- a/include/linux/audit.h > > > +++ b/include/linux/audit.h > > > @@ -387,6 +387,18 @@ static inline int audit_socketcall(int > > > nargs, > > > unsigned long *args) > > >   return __audit_socketcall(nargs, args); > > >   return 0; > > >  } > > > +static inline int audit_socketcall_compat(int nargs, u32 *args) > > > +{ > > > + if (unlikely(!audit_dummy_context())) { > > > > I've always hated these likely/unlikely. Mostly because I think > > they > > are so often wrong. I believe this says that you compiled audit in > > but > > you expect it to be explicitly disabled. While that is (recently) > > true > > in Fedora I highly doubt that's true on the vast majority of > > systems > > that have audit compiled in. > > It has been argued that audit should have pretty much no performance > impact if it is not in use and that if it is, we're willing to take > the > more significant overhead of the rest of the code for the sake of one > test to determine whether or not to follow this code path. Ok, I can buy that argument. Not sure its where I would have settled, but it does make sense. I'll obviously defer to Paul on what he wants out of style. I always assume the compiler is brilliant and write stupid code but your logic is sound there too. You can/should pretend I said nothing.