Audit issue

[Steve Grubb]

On Thursday 08 November 2007 09:32:18 Alexander Viro wrote:
> > Thanks for posting this patch. Is it impossible to "repair " processes by
> > simply adding a context if the pointer is NULL?
>
> At which point would you do that?

Possibly on syscall exit? Shouldn't the kernel have released all locks by that 
point? And what about syscall entry...isn't that before any locking starts to 
occur?

> I'd rather not try to play with locking, etc., when we set audit_enabled to
> non-zero...

Sure.

> Especially when there's a trivially non-intrusive patch.

True, but I'm thinking this will cause performance to go down if the audit 
system was ever enabled. It doesn't look as bad as the audit system actually 
being on, but it may be doing unnecessary allocations I think.

-Steve