linux-kernel - [PATCH -next 0/1] audit: ignore userspace log when backlog limit exceeded and backlog_wait

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 28 Dec 2021 14:50:22 +0800
From:   luhuaxin <luhuaxin1@...wei.com>
To:     <paul@...l-moore.com>, <eparis@...hat.com>
CC:     <linux-audit@...hat.com>, <linux-kernel@...r.kernel.org>,
        <fangxiuning@...wei.com>
Subject: [PATCH -next 0/1] audit: ignore userspace log when backlog limit exceeded and backlog_wait_time is 0

The audit backlog overflow is an actual problem in our system. We set
the backlog_wait_time to 0 for improving OS performance. Therefore,
under the impact of a large number of audit logs produced by sudo, the
backlog in buffer will greatly exceed backlog_limit.

When the backlog exceed the backlog_limit and backlog_wait_time is set
to 0, the process will only sleep for a very short time (jiffies). The
backlog may still exceed backlog_limit in extreme cases.

The more reasonable way to fix this problem is:

1. If backlog_wait_time is set to zero, ignore the log;
2. If backlog_wait_time is set to non-zero, let process sleep for
backlog_wait_time.

The above log limit logic is also the same as that in the existing
audit_log_start function.

This may not be a perfect solution, a further discussion maybe
necessary.

luhuaxin (1):
  audit: ignore userspace log when backlog limit exceeded and
    backlog_wait_time is 0

 kernel/audit.c | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

-- 
2.23.0