From: Paul Moore <paul@paul-moore.com> To: Jens Axboe <axboe@kernel.dk> Cc: Richard Guy Briggs <rgb@redhat.com>, Linux-Audit Mailing List <linux-audit@redhat.com>, LKML <linux-kernel@vger.kernel.org>, io-uring@vger.kernel.org, Eric Paris <eparis@parisplace.org>, Steve Grubb <sgrubb@redhat.com>, Stefan Roesch <shr@fb.com>, Christian Brauner <brauner@kernel.org>, Pavel Begunkov <asml.silence@gmail.com> Subject: Re: [PATCH v1 1/2] io_uring,audit: audit IORING_OP_FADVISE but not IORING_OP_MADVISE Date: Fri, 27 Jan 2023 17:57:30 -0500 [thread overview] Message-ID: <CAHC9VhSfG6Oddk3qeFYiwkE5orRKs_PCLAD+F0yK-fRx27UTwg@mail.gmail.com> (raw) In-Reply-To: <6d3f76ae-9f86-a96e-d540-cfd45475e288@kernel.dk> On Fri, Jan 27, 2023 at 5:45 PM Jens Axboe <axboe@kernel.dk> wrote: > On 1/27/23 3:35?PM, Paul Moore wrote: > > On Fri, Jan 27, 2023 at 12:24 PM Richard Guy Briggs <rgb@redhat.com> wrote: > >> > >> Since FADVISE can truncate files and MADVISE operates on memory, reverse > >> the audit_skip tags. > >> > >> Fixes: 5bd2182d58e9 ("audit,io_uring,io-wq: add some basic audit support to io_uring") > >> Signed-off-by: Richard Guy Briggs <rgb@redhat.com> > >> --- > >> io_uring/opdef.c | 2 +- > >> 1 file changed, 1 insertion(+), 1 deletion(-) > >> > >> diff --git a/io_uring/opdef.c b/io_uring/opdef.c > >> index 3aa0d65c50e3..a2bf53b4a38a 100644 > >> --- a/io_uring/opdef.c > >> +++ b/io_uring/opdef.c > >> @@ -306,12 +306,12 @@ const struct io_op_def io_op_defs[] = { > >> }, > >> [IORING_OP_FADVISE] = { > >> .needs_file = 1, > >> - .audit_skip = 1, > >> .name = "FADVISE", > >> .prep = io_fadvise_prep, > >> .issue = io_fadvise, > >> }, > > > > I've never used posix_fadvise() or the associated fadvise64*() > > syscalls, but from quickly reading the manpages and the > > generic_fadvise() function in the kernel I'm missing where the fadvise > > family of functions could be used to truncate a file, can you show me > > where this happens? The closest I can see is the manipulation of the > > page cache, but that shouldn't actually modify the file ... right? > > Yeah, honestly not sure where that came from. Maybe it's being mixed up > with fallocate? That was my thought too when I was looking at it. > All fadvise (or madvise, for that matter) does is > provide hints on the caching or access pattern. On second thought, both > of these should be able to set audit_skip as far as I can tell. Agreed on the fadvise side, and probably the madvise side too, although the latter has more options/code to sift through so I'm curious to hear what analysis Richard has done on that one. -- paul-moore.com
WARNING: multiple messages have this Message-ID (diff)
From: Paul Moore <paul@paul-moore.com> To: Jens Axboe <axboe@kernel.dk> Cc: Christian Brauner <brauner@kernel.org>, Richard Guy Briggs <rgb@redhat.com>, LKML <linux-kernel@vger.kernel.org>, Pavel Begunkov <asml.silence@gmail.com>, Linux-Audit Mailing List <linux-audit@redhat.com>, Stefan Roesch <shr@fb.com>, Eric Paris <eparis@parisplace.org>, io-uring@vger.kernel.org Subject: Re: [PATCH v1 1/2] io_uring, audit: audit IORING_OP_FADVISE but not IORING_OP_MADVISE Date: Fri, 27 Jan 2023 17:57:30 -0500 [thread overview] Message-ID: <CAHC9VhSfG6Oddk3qeFYiwkE5orRKs_PCLAD+F0yK-fRx27UTwg@mail.gmail.com> (raw) In-Reply-To: <6d3f76ae-9f86-a96e-d540-cfd45475e288@kernel.dk> On Fri, Jan 27, 2023 at 5:45 PM Jens Axboe <axboe@kernel.dk> wrote: > On 1/27/23 3:35?PM, Paul Moore wrote: > > On Fri, Jan 27, 2023 at 12:24 PM Richard Guy Briggs <rgb@redhat.com> wrote: > >> > >> Since FADVISE can truncate files and MADVISE operates on memory, reverse > >> the audit_skip tags. > >> > >> Fixes: 5bd2182d58e9 ("audit,io_uring,io-wq: add some basic audit support to io_uring") > >> Signed-off-by: Richard Guy Briggs <rgb@redhat.com> > >> --- > >> io_uring/opdef.c | 2 +- > >> 1 file changed, 1 insertion(+), 1 deletion(-) > >> > >> diff --git a/io_uring/opdef.c b/io_uring/opdef.c > >> index 3aa0d65c50e3..a2bf53b4a38a 100644 > >> --- a/io_uring/opdef.c > >> +++ b/io_uring/opdef.c > >> @@ -306,12 +306,12 @@ const struct io_op_def io_op_defs[] = { > >> }, > >> [IORING_OP_FADVISE] = { > >> .needs_file = 1, > >> - .audit_skip = 1, > >> .name = "FADVISE", > >> .prep = io_fadvise_prep, > >> .issue = io_fadvise, > >> }, > > > > I've never used posix_fadvise() or the associated fadvise64*() > > syscalls, but from quickly reading the manpages and the > > generic_fadvise() function in the kernel I'm missing where the fadvise > > family of functions could be used to truncate a file, can you show me > > where this happens? The closest I can see is the manipulation of the > > page cache, but that shouldn't actually modify the file ... right? > > Yeah, honestly not sure where that came from. Maybe it's being mixed up > with fallocate? That was my thought too when I was looking at it. > All fadvise (or madvise, for that matter) does is > provide hints on the caching or access pattern. On second thought, both > of these should be able to set audit_skip as far as I can tell. Agreed on the fadvise side, and probably the madvise side too, although the latter has more options/code to sift through so I'm curious to hear what analysis Richard has done on that one. -- paul-moore.com -- Linux-audit mailing list Linux-audit@redhat.com https://listman.redhat.com/mailman/listinfo/linux-audit
next prev parent reply other threads:[~2023-01-27 22:57 UTC|newest] Thread overview: 61+ messages / expand[flat|nested] mbox.gz Atom feed top 2023-01-27 17:23 [PATCH v1 0/2] two suggested iouring op audit updates Richard Guy Briggs 2023-01-27 17:23 ` Richard Guy Briggs 2023-01-27 17:23 ` [PATCH v1 1/2] io_uring,audit: audit IORING_OP_FADVISE but not IORING_OP_MADVISE Richard Guy Briggs 2023-01-27 17:23 ` [PATCH v1 1/2] io_uring, audit: " Richard Guy Briggs 2023-01-27 22:35 ` [PATCH v1 1/2] io_uring,audit: " Paul Moore 2023-01-27 22:35 ` [PATCH v1 1/2] io_uring, audit: " Paul Moore 2023-01-27 22:45 ` [PATCH v1 1/2] io_uring,audit: " Jens Axboe 2023-01-27 22:45 ` Jens Axboe 2023-01-27 22:57 ` Paul Moore [this message] 2023-01-27 22:57 ` [PATCH v1 1/2] io_uring, audit: " Paul Moore 2023-01-28 16:48 ` [PATCH v1 1/2] io_uring,audit: " Steve Grubb 2023-01-28 16:48 ` Steve Grubb 2023-01-27 23:02 ` Richard Guy Briggs 2023-01-27 23:02 ` Richard Guy Briggs 2023-01-27 23:03 ` Jens Axboe 2023-01-27 23:03 ` Jens Axboe 2023-01-27 23:08 ` Richard Guy Briggs 2023-01-27 23:08 ` Richard Guy Briggs 2023-01-27 22:55 ` Richard Guy Briggs 2023-01-27 22:55 ` Richard Guy Briggs 2023-01-27 23:05 ` Paul Moore 2023-01-27 23:05 ` [PATCH v1 1/2] io_uring, audit: " Paul Moore 2023-01-27 17:23 ` [PATCH v1 2/2] io_uring,audit: do not log IORING_OP_*GETXATTR Richard Guy Briggs 2023-01-27 17:23 ` Richard Guy Briggs 2023-01-27 22:43 ` Paul Moore 2023-01-27 22:43 ` Paul Moore 2023-01-27 23:01 ` Richard Guy Briggs 2023-01-27 23:01 ` Richard Guy Briggs 2023-01-27 23:05 ` Jens Axboe 2023-01-28 0:07 ` Paul Moore 2023-01-28 0:06 ` Paul Moore 2023-01-28 0:06 ` Paul Moore 2023-01-28 0:19 ` Richard Guy Briggs 2023-01-28 0:19 ` Richard Guy Briggs 2023-01-28 17:26 ` Steve Grubb 2023-01-28 17:26 ` Steve Grubb 2023-01-29 23:37 ` Paul Moore 2023-01-29 23:37 ` Paul Moore 2023-01-27 17:40 ` [PATCH v1 0/2] two suggested iouring op audit updates Jens Axboe 2023-01-27 17:40 ` Jens Axboe 2023-01-27 19:42 ` Paul Moore 2023-01-27 19:42 ` Paul Moore 2023-01-27 19:43 ` Jens Axboe 2023-01-27 19:43 ` Jens Axboe 2023-01-27 22:38 ` Paul Moore 2023-01-27 22:38 ` Paul Moore 2023-01-27 22:46 ` Jens Axboe 2023-01-27 22:46 ` Jens Axboe 2023-01-27 22:53 ` Paul Moore 2023-01-27 22:53 ` Paul Moore 2023-01-27 23:02 ` Jens Axboe 2023-01-27 23:02 ` Jens Axboe 2023-01-27 23:07 ` Richard Guy Briggs 2023-01-27 23:07 ` Richard Guy Briggs 2023-01-27 23:08 ` Paul Moore 2023-01-27 23:08 ` Paul Moore 2023-01-27 23:10 ` Jens Axboe 2023-01-28 16:47 ` Steve Grubb 2023-01-28 16:47 ` Steve Grubb 2023-01-28 17:03 ` Paul Moore 2023-01-28 17:03 ` Paul Moore
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=CAHC9VhSfG6Oddk3qeFYiwkE5orRKs_PCLAD+F0yK-fRx27UTwg@mail.gmail.com \ --to=paul@paul-moore.com \ --cc=asml.silence@gmail.com \ --cc=axboe@kernel.dk \ --cc=brauner@kernel.org \ --cc=eparis@parisplace.org \ --cc=io-uring@vger.kernel.org \ --cc=linux-audit@redhat.com \ --cc=linux-kernel@vger.kernel.org \ --cc=rgb@redhat.com \ --cc=sgrubb@redhat.com \ --cc=shr@fb.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.