From mboxrd@z Thu Jan 1 00:00:00 1970 From: Richard Guy Briggs Subject: Re: [PATCH 14/14] audit: enable audit_get/put_mark() Date: Wed, 18 Jun 2014 16:21:18 -0400 Message-ID: <20140618202118.GG19353@madcap2.tricolour.ca> References: <42425ec84afea28f141ec8ff0ef40d86246a5f32.1403060033.git.rgb@redhat.com> <20140618100931.3c2e9d38@flatline.rdu.redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Content-Disposition: inline In-Reply-To: <20140618100931.3c2e9d38@flatline.rdu.redhat.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Eric Paris Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com On 14/06/18, Eric Paris wrote: > Aside from the refcounting in the previous patch being bad, which you > likely didn't make any better here, I think I'm ok with > audit_put_mark/audit_get_mark being exposed and used instead of the > fsnotify_* calls being used directly... I still need to convince myself they are needed, but I'll figure that out after I read more carefully your comments to the previous patch. > On Tue, 17 Jun 2014 23:09:49 -0400 > Richard Guy Briggs wrote: > > --- > > kernel/audit.h | 2 ++ > > kernel/audit_fsnotify.c | 6 +++--- > > kernel/auditfilter.c | 10 +++++----- > > 3 files changed, 10 insertions(+), 8 deletions(-) > > > > diff --git a/kernel/audit.h b/kernel/audit.h > > index 2093c5e..3151ae5 100644 > > --- a/kernel/audit.h > > +++ b/kernel/audit.h > > @@ -288,6 +288,8 @@ char *audit_mark_path(struct audit_fsnotify_mark > > *mark); int audit_add_mark_rule(struct audit_krule *krule, struct > > list_head **list); void audit_remove_mark(struct audit_fsnotify_mark > > *audit_mark); int audit_mark_compare(struct audit_fsnotify_mark > > *mark, unsigned long ino, dev_t dev); +void audit_get_mark(struct > > audit_fsnotify_mark *audit_mark); +void audit_put_mark(struct > > audit_fsnotify_mark *audit_mark); > > int audit_dup_exe(struct audit_krule *new, struct audit_krule *old); > > int audit_exe_compare(struct task_struct *tsk, struct > > audit_fsnotify_mark *mark); diff --git a/kernel/audit_fsnotify.c > > b/kernel/audit_fsnotify.c index cc4175a..f5789e1 100644 > > --- a/kernel/audit_fsnotify.c > > +++ b/kernel/audit_fsnotify.c > > @@ -65,14 +65,14 @@ static void audit_free_fsnotify_mark(struct > > fsnotify_mark *mark) audit_free_mark(audit_mark); > > } > > > > -#if 0 /* not sure if we need these... */ > > -static void audit_get_mark(struct audit_fsnotify_mark *audit_mark) > > +#if 1 /* not sure if we need these... */ > > +void audit_get_mark(struct audit_fsnotify_mark *audit_mark) > > { > > if (likely(audit_mark)) > > fsnotify_get_mark(&audit_mark->mark); > > } > > > > -static void audit_put_mark(struct audit_fsnotify_mark *audit_mark) > > +void audit_put_mark(struct audit_fsnotify_mark *audit_mark) > > { > > if (likely(audit_mark)) > > fsnotify_put_mark(&audit_mark->mark); > > diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c > > index 7b6e892..3d168ca 100644 > > --- a/kernel/auditfilter.c > > +++ b/kernel/auditfilter.c > > @@ -81,7 +81,7 @@ static inline void audit_free_rule(struct > > audit_entry *e) if (erule->watch) > > audit_put_watch(erule->watch); > > if (erule->exe) > > - fsnotify_put_mark(erule->exe->mark); > > + audit_put_mark(erule->exe); > > if (erule->fields) > > for (i = 0; i < erule->field_count; i++) { > > struct audit_field *f = &erule->fields[i]; > > @@ -569,7 +569,7 @@ static struct audit_entry > > *audit_data_to_entry(struct audit_rule_data *data, err = > > PTR_ERR(audit_mark); goto exit_free; > > } > > - fsnotify_get_mark(audit_mark->mark); > > + audit_get_mark(audit_mark); > > entry->rule.exe = audit_mark; > > break; > > } > > @@ -587,7 +587,7 @@ exit_free: > > if (entry->rule.tree) > > audit_put_tree(entry->rule.tree); /* that's the > > temporary one */ if (entry->rule.exe) > > - fsnotify_put_mark(entry->rule.exe->mark); /* matches > > initial get */ > > + audit_put_mark(entry->rule.exe); /* matches initial > > get */ audit_free_rule(entry); > > return ERR_PTR(err); > > } > > @@ -991,7 +991,7 @@ error: > > if (watch) > > audit_put_watch(watch); /* tmp watch, matches > > initial get */ if (exe) > > - fsnotify_put_mark(exe->mark); /* tmp mark, matches > > initial get */ > > + audit_put_mark(exe); /* tmp mark, matches initial > > get */ return err; > > } > > > > @@ -1049,7 +1049,7 @@ out: > > if (tree) > > audit_put_tree(tree); /* that's the temporary > > one */ if (exe) > > - fsnotify_put_mark(exe->mark); /* match > > initial get */ > > + audit_put_mark(exe); /* match initial get */ > > > > return ret; > > } > - RGB -- Richard Guy Briggs Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, Red Hat Remote, Ottawa, Canada Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545