linux-kernel - Re: [RFC PATCH 1/3] audit: remove arch_f pointer from struct audit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAHC9VhRpYpkVN5fan91g96YuR9GjT=6TbV7vngtS1Crm72+Knw@mail.gmail.com>
Date:   Mon, 26 Nov 2018 11:37:54 -0500
From:   Paul Moore <paul@...l-moore.com>
To:     rgb@...hat.com
Cc:     linux-audit@...hat.com, linux-kernel@...r.kernel.org
Subject: Re: [RFC PATCH 1/3] audit: remove arch_f pointer from struct audit_krule

On Sun, Nov 25, 2018 at 12:11 PM Richard Guy Briggs <rgb@...hat.com> wrote:
> On 2018-02-15 15:42, Paul Moore wrote:
> > On Mon, Feb 12, 2018 at 7:29 AM, Richard Guy Briggs <rgb@...hat.com> wrote:
> > > The arch_f pointer was added to the struct audit_krule in commit:
> > > e54dc2431d740a79a6bd013babade99d71b1714f ("audit signal recipients")
> > >
> > > This is only used on addition and deletion of rules which isn't time
> > > critical and the arch field is likely to be one of the first fields,
> > > easily found iterating over the field type.  This isn't worth the
> > > additional complexity and storage.  Delete the field.
> > >
> > > Signed-off-by: Richard Guy Briggs <rgb@...hat.com>
> > > ---
> > >  include/linux/audit.h |  1 -
> > >  kernel/auditfilter.c  | 12 ++++++++----
> > >  2 files changed, 8 insertions(+), 5 deletions(-)
> >
> > I haven't decided if I like the removal of arch_f or not, but I think
> > I might know where your oops/panic is coming from, thoughts below ...
>
> Have you decided yet if you like the removal of the arch_f pointer or
> not?  An updated v2 was provided the following day:
>         https://www.redhat.com/archives/linux-audit/2018-February/msg00059.html

I still think I'd like to keep it as-is for now.

-- 
paul moore
www.paul-moore.com