linux-kernel - Re: audit_reusename in getname

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <956b43574bcb149579ecac7a3ab98ad29dddc275.camel@kernel.org>
Date: Thu, 06 Feb 2025 15:24:24 -0500
From: Jeff Layton <jlayton@...nel.org>
To: Mateusz Guzik <mjguzik@...il.com>
Cc: Christian Brauner <brauner@...nel.org>, Al Viro
 <viro@...iv.linux.org.uk>,  Jan Kara <jack@...e.cz>, linux-fsdevel
 <linux-fsdevel@...r.kernel.org>, linux-kernel	
 <linux-kernel@...r.kernel.org>, audit@...r.kernel.org, Paul Moore	
 <paul@...l-moore.com>, Eric Paris <eparis@...hat.com>
Subject: Re: audit_reusename in getname_flags

On Thu, 2025-02-06 at 20:07 +0100, Mateusz Guzik wrote:
> You added it in:
> commit 7ac86265dc8f665cc49d6e60a125e608cd2fca14
> Author: Jeff Layton <jlayton@...nel.org>
> Date:   Wed Oct 10 15:25:28 2012 -0400
> 
>     audit: allow audit code to satisfy getname requests from its names_list
> 
> Do I read correctly this has no user-visible impact, but merely tries
> to shave off some memory usage in case of duplicated user bufs?
> 
> This is partially getting in the way of whacking atomics for filename
> ref management (but can be worked around).
> 
> AFAIU this change is not all *that* beneficial in its own right, so
> should not be a big deal to whack it regardless of what happens with
> refs? Note it would also remove some branches in the common case as
> normally audit either has dummy context or there is no match anyway.


(cc'ing audit folks and mailing list)

IIRC, having duplicate audit_names records can cause audit to emit
extra name records in this loop in audit_log_exit():

        list_for_each_entry(n, &context->names_list, list) { 
                if (n->hidden)
                        continue;
                audit_log_name(context, n, NULL, i++, &call_panic);
        }


...which is something you probably want to avoid.
-- 
Jeff Layton <jlayton@...nel.org>