linux-kernel - [PATCH -next 1/1] audit: ignore userspace log when backlog limit exceeded and backlog_wait

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 28 Dec 2021 14:50:23 +0800
From:   luhuaxin <luhuaxin1@...wei.com>
To:     <paul@...l-moore.com>, <eparis@...hat.com>
CC:     <linux-audit@...hat.com>, <linux-kernel@...r.kernel.org>,
        <fangxiuning@...wei.com>
Subject: [PATCH -next 1/1] audit: ignore userspace log when backlog limit exceeded and backlog_wait_time is 0

When the backlog exceed the backlog_limit and backlog_wait_time is set
to 0, the process will only sleep for a very short time (jiffies). The
backlog may still exceed backlog_limit in extreme cases.

The more reasonable way to fix this problem is:

1. If backlog_wait_time is set to zero, ignore the log;
2. If backlog_wait_time is set to non-zero, let process sleep for
backlog_wait_time.

The above log limit logic is also the same as that in the existing
audit_log_start function.

Fixes: 8f110f530635 ("[PATCH] audit: ensure userspace is penalized the
  same as the kernel when under pressure")
Signed-off-by: luhuaxin <luhuaxin1@...wei.com>
---
 kernel/audit.c | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/kernel/audit.c b/kernel/audit.c
index 249e11628..70450f70a 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -1545,7 +1545,8 @@ static void audit_receive(struct sk_buff  *skb)
 
 	/* can't block with the ctrl lock, so penalize the sender now */
 	if (audit_backlog_limit &&
-	    (skb_queue_len(&audit_queue) > audit_backlog_limit)) {
+	    (skb_queue_len(&audit_queue) > audit_backlog_limit) &&
+	    audit_backlog_wait_time) {
 		DECLARE_WAITQUEUE(wait, current);
 
 		/* wake kauditd to try and flush the queue */
@@ -1842,9 +1843,8 @@ struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask,
 	 *    while holding the mutex, although we do penalize the sender
 	 *    later in audit_receive() when it is safe to block
 	 */
+	long stime = audit_backlog_wait_time;
 	if (!(auditd_test_task(current) || audit_ctl_owner_current())) {
-		long stime = audit_backlog_wait_time;
-
 		while (audit_backlog_limit &&
 		       (skb_queue_len(&audit_queue) > audit_backlog_limit)) {
 			/* wake kauditd to try and flush the queue */
@@ -1872,6 +1872,14 @@ struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask,
 				return NULL;
 			}
 		}
+	} else if (!stime && audit_backlog_limit &&
+		   (skb_queue_len(&audit_queue) > audit_backlog_limit)) {
+		if (audit_rate_check() && printk_ratelimit())
+			pr_warn("audit_backlog=%d > audit_backlog_limit=%d\n",
+				skb_queue_len(&audit_queue),
+				audit_backlog_limit);
+		audit_log_lost("backlog limit exceeded");
+		return NULL;
 	}
 
 	ab = audit_buffer_alloc(ctx, gfp_mask, type);
-- 
2.23.0