[RFC PATCH 3/7] audit: allow systemd to use queue reserves

[Richard Guy Briggs]

On 15/11/05, Paul Moore wrote:
> On Thursday, October 22, 2015 03:51:59 PM Richard Guy Briggs wrote:
> > On 15/10/22, Steve Grubb wrote:
> > > On Thursday, October 22, 2015 02:53:16 PM Richard Guy Briggs wrote:
> > > > Treat systemd the same way as auditd, allowing it to overrun the queue
> > > > to avoid blocking.
> > > 
> > > Do you mind explaining this a little more? I'm having a hard time
> > > understanding how systemd is involved.
> > 
> > systemd should only have CAP_AUDIT_READ for the multicast socket and
> > otherwise behaves as a user client, sending AUDIT_USER_* messages.  It
> > starts and stops auditd and we don't want it blocking trying to allocate
> > a buffer on the standard queue in audit_log_start() while it is tasked
> > with telling auditd to start or stop.
> 
> Is this something we are hearing reports about?  Starting and stopping auditd 
> should be rare in normal use, and by rare I mean start it at boot and don't 
> touch it again ... although I suspect you might update/patch it at some point 
> if your system is long running.

(Sorry, this message has been on my queue for a while...)

Well, it is touched again, when shutting down the machine, or upgrading
auditd.  There also seem to be issues when the logs are rotated.  This
first case is the one I've been working on that caused all this
examination and instrumentation.  systemd was chucking in a couple dozen
messages onto the queue on startup

> If this is a common problem we can look at doing something like this, but if 
> it isn't - and I don't think it is - I'd like to avoid special casing init 
> (it's even more specialized since we are basically talking about just systemd, 
> although others could have similar prblems).
> 
> > > -Steve
> > > 
> > > > Signed-off-by: Richard Guy Briggs <rgb at redhat.com>
> > > > ---
> >  > 
> > > >  kernel/audit.c |    2 +-
> > > >  1 files changed, 1 insertions(+), 1 deletions(-)
> > > > 
> > > > diff --git a/kernel/audit.c b/kernel/audit.c
> > > > index 3917aad..384a1a1 100644
> > > > --- a/kernel/audit.c
> > > > +++ b/kernel/audit.c
> > > > @@ -1375,7 +1375,7 @@ struct audit_buffer *audit_log_start(struct
> > > > audit_context *ctx, gfp_t gfp_mask, return NULL;
> > > > 
> > > >  	if (gfp_mask & __GFP_WAIT) {
> > > > 
> > > > -		if (audit_pid && audit_pid == current->tgid)
> > > > +		if (current->tgid == 1 || (audit_pid && audit_pid == current-
> >tgid))
> > > > 
> > > >  			gfp_mask &= ~__GFP_WAIT;
> > > >  		
> > > >  		else
> > > >  		
> > > >  			reserve = 0;
> > 
> > - RGB
> 
> paul moore

- RGB

--
Richard Guy Briggs <rbriggs at redhat.com>
Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, Red Hat
Remote, Ottawa, Canada
Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545