linux-kernel - [PATCH -next,v2] audit: only print records that will be dropped via printk()

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Wed, 23 Feb 2022 17:35:59 +0800
From:   Gaosheng Cui <cuigaosheng1@...wei.com>
To:     <paul@...l-moore.com>, <eparis@...hat.com>
CC:     <linux-audit@...hat.com>, <linux-kernel@...r.kernel.org>,
        <wangweiyang2@...wei.com>, <xiujianfeng@...wei.com>
Subject: [PATCH -next,v2] audit: only print records that will be dropped via printk()

When an admin enables audit at early boot via the "audit=1" kernel
command line, netlink send errors seen will cause the audit subsystem
to drop some records or return records to the queue. And all records
will be printed via printk() in the kauditd_hold_skb(), but actually
only the records that will be dropped need to be printed via printk().

Signed-off-by: Gaosheng Cui <cuigaosheng1@...wei.com>
---
 kernel/audit.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/kernel/audit.c b/kernel/audit.c
index 7690c29d4ee4..eb3e44c849be 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -568,10 +568,6 @@ static void kauditd_rehold_skb(struct sk_buff *skb, __always_unused int error)
  */
 static void kauditd_hold_skb(struct sk_buff *skb, int error)
 {
-	/* at this point it is uncertain if we will ever send this to auditd so
-	 * try to send the message via printk before we go any further */
-	kauditd_printk_skb(skb);
-
 	/* can we just silently drop the message? */
 	if (!audit_default)
 		goto drop;
@@ -600,6 +596,11 @@ static void kauditd_hold_skb(struct sk_buff *skb, int error)
 	/* we have no other options - drop the message */
 	audit_log_lost("kauditd hold queue overflow");
 drop:
+	/* at this point it is uncertain if we will ever send this to auditd so
+	 * try to send the message via printk before we go any further
+	 */
+	kauditd_printk_skb(skb);
+
 	kfree_skb(skb);
 }
 
-- 
2.30.0