lkml.org 
[lkml]   [2021]   [Dec]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH -next 1/1] audit: ignore userspace log when backlog limit exceeded and backlog_wait_time is 0
Date
When the backlog exceed the backlog_limit and backlog_wait_time is set
to 0, the process will only sleep for a very short time (jiffies). The
backlog may still exceed backlog_limit in extreme cases.

The more reasonable way to fix this problem is:

1. If backlog_wait_time is set to zero, ignore the log;
2. If backlog_wait_time is set to non-zero, let process sleep for
backlog_wait_time.

The above log limit logic is also the same as that in the existing
audit_log_start function.

Fixes: 8f110f530635 ("[PATCH] audit: ensure userspace is penalized the
same as the kernel when under pressure")
Signed-off-by: luhuaxin <luhuaxin1@huawei.com>
---
kernel/audit.c | 14 +++++++++++---
1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/kernel/audit.c b/kernel/audit.c
index 249e11628..70450f70a 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -1545,7 +1545,8 @@ static void audit_receive(struct sk_buff *skb)

/* can't block with the ctrl lock, so penalize the sender now */
if (audit_backlog_limit &&
- (skb_queue_len(&audit_queue) > audit_backlog_limit)) {
+ (skb_queue_len(&audit_queue) > audit_backlog_limit) &&
+ audit_backlog_wait_time) {
DECLARE_WAITQUEUE(wait, current);

/* wake kauditd to try and flush the queue */
@@ -1842,9 +1843,8 @@ struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask,
* while holding the mutex, although we do penalize the sender
* later in audit_receive() when it is safe to block
*/
+ long stime = audit_backlog_wait_time;
if (!(auditd_test_task(current) || audit_ctl_owner_current())) {
- long stime = audit_backlog_wait_time;
-
while (audit_backlog_limit &&
(skb_queue_len(&audit_queue) > audit_backlog_limit)) {
/* wake kauditd to try and flush the queue */
@@ -1872,6 +1872,14 @@ struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask,
return NULL;
}
}
+ } else if (!stime && audit_backlog_limit &&
+ (skb_queue_len(&audit_queue) > audit_backlog_limit)) {
+ if (audit_rate_check() && printk_ratelimit())
+ pr_warn("audit_backlog=%d > audit_backlog_limit=%d\n",
+ skb_queue_len(&audit_queue),
+ audit_backlog_limit);
+ audit_log_lost("backlog limit exceeded");
+ return NULL;
}

ab = audit_buffer_alloc(ctx, gfp_mask, type);
--
2.23.0
\
 
 \ /
  Last update: 2021-12-28 07:51    [W:0.042 / U:0.852 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site