linux-kernel - Re: [RFC PATCH 1/3] audit: remove arch_f pointer from struct audit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 26 Nov 2018 14:21:38 -0500
From:   Richard Guy Briggs <rgb@...hat.com>
To:     Paul Moore <paul@...l-moore.com>
Cc:     linux-audit@...hat.com, linux-kernel@...r.kernel.org
Subject: Re: [RFC PATCH 1/3] audit: remove arch_f pointer from struct
 audit_krule

On 2018-11-26 11:37, Paul Moore wrote:
> On Sun, Nov 25, 2018 at 12:11 PM Richard Guy Briggs <rgb@...hat.com> wrote:
> > On 2018-02-15 15:42, Paul Moore wrote:
> > > On Mon, Feb 12, 2018 at 7:29 AM, Richard Guy Briggs <rgb@...hat.com> wrote:
> > > > The arch_f pointer was added to the struct audit_krule in commit:
> > > > e54dc2431d740a79a6bd013babade99d71b1714f ("audit signal recipients")
> > > >
> > > > This is only used on addition and deletion of rules which isn't time
> > > > critical and the arch field is likely to be one of the first fields,
> > > > easily found iterating over the field type.  This isn't worth the
> > > > additional complexity and storage.  Delete the field.
> > > >
> > > > Signed-off-by: Richard Guy Briggs <rgb@...hat.com>
> > > > ---
> > > >  include/linux/audit.h |  1 -
> > > >  kernel/auditfilter.c  | 12 ++++++++----
> > > >  2 files changed, 8 insertions(+), 5 deletions(-)
> > >
> > > I haven't decided if I like the removal of arch_f or not, but I think
> > > I might know where your oops/panic is coming from, thoughts below ...
> >
> > Have you decided yet if you like the removal of the arch_f pointer or
> > not?  An updated v2 was provided the following day:
> >         https://www.redhat.com/archives/linux-audit/2018-February/msg00059.html
> 
> I still think I'd like to keep it as-is for now.

Can you explain why you'd prefer to keep it as-is for now?  Is there a
factor I'm not aware of that might make it acceptable later?  arch_f
appears to make the code noisier than needed and use extra memory that
is a convenience at best only when adding or deleting rules.

> paul moore

- RGB

--
Richard Guy Briggs <rgb@...hat.com>
Sr. S/W Engineer, Kernel Security, Base Operating Systems
Remote, Ottawa, Red Hat Canada
IRC: rgb, SunRaycer
Voice: +1.647.777.2635, Internal: (81) 32635