Re: [RFC PATCH 1/3] audit: remove arch_f pointer from struct audit_krule

[Richard Guy Briggs <rgb@redhat.com>]

On 2018-11-26 11:37, Paul Moore wrote:
> On Sun, Nov 25, 2018 at 12:11 PM Richard Guy Briggs <rgb@redhat.com> wrote:
> > On 2018-02-15 15:42, Paul Moore wrote:
> > > On Mon, Feb 12, 2018 at 7:29 AM, Richard Guy Briggs <rgb@redhat.com> wrote:
> > > > The arch_f pointer was added to the struct audit_krule in commit:
> > > > e54dc2431d740a79a6bd013babade99d71b1714f ("audit signal recipients")
> > > >
> > > > This is only used on addition and deletion of rules which isn't time
> > > > critical and the arch field is likely to be one of the first fields,
> > > > easily found iterating over the field type.  This isn't worth the
> > > > additional complexity and storage.  Delete the field.
> > > >
> > > > Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
> > > > ---
> > > >  include/linux/audit.h |  1 -
> > > >  kernel/auditfilter.c  | 12 ++++++++----
> > > >  2 files changed, 8 insertions(+), 5 deletions(-)
> > >
> > > I haven't decided if I like the removal of arch_f or not, but I think
> > > I might know where your oops/panic is coming from, thoughts below ...
> >
> > Have you decided yet if you like the removal of the arch_f pointer or
> > not?  An updated v2 was provided the following day:
> >         https://www.redhat.com/archives/linux-audit/2018-February/msg00059.html
> 
> I still think I'd like to keep it as-is for now.

Can you explain why you'd prefer to keep it as-is for now?  Is there a
factor I'm not aware of that might make it acceptable later?  arch_f
appears to make the code noisier than needed and use extra memory that
is a convenience at best only when adding or deleting rules.

> paul moore

- RGB

--
Richard Guy Briggs <rgb@redhat.com>
Sr. S/W Engineer, Kernel Security, Base Operating Systems
Remote, Ottawa, Red Hat Canada
IRC: rgb, SunRaycer
Voice: +1.647.777.2635, Internal: (81) 32635