From: Paul Moore <paul@paul-moore.com>
To: Alexander Viro <aviro@redhat.com>
Cc: linux-audit@redhat.com
Subject: Re: [RFC] audit: allow audit_reusename to check kernel path
Date: Wed, 27 May 2020 09:23:46 -0400 [thread overview]
Message-ID: <CAHC9VhQW+zt7zEkLNT4rv7_sQOmC1NUq8Mh=5Xs5RZwcWLFcVg@mail.gmail.com> (raw)
In-Reply-To: <20200527003651.GA97661@shell-el7.hosts.prod.upshift.rdu2.redhat.com>
On Tue, May 26, 2020 at 8:37 PM Alexander Viro <aviro@redhat.com> wrote:
> On Tue, May 26, 2020 at 08:32:06AM -0400, Paul Moore wrote:
> > On Mon, May 25, 2020 at 3:22 AM Yiwen Gu <guyiwen@huawei.com> wrote:
> > > For now, we met a situation where the audit_reusename checking
> > > function returns the same filename structure for files sharing
> > > the same uptr. However, these files are different, and we are trying
> > > to open them in a loop where the names are loaded into the same address.
> > > Therefore, the function returns the same structure for different files.
> > > By the way, may I ask in what situation would the audit_list be kept
> > > across syscalls?
>
> Never. "reuse" is strictly within the same syscall, so e.g. -ESTALE
> retry logics doesn't have to worry about extra instances of struct
> filename.
I think there is something odd with the kernel that Yiwen Gu is
running; they posted a similar patch back in April (link below) and we
talked about it then. The patch didn't make sense in April and it
still doesn't make sense to me now.
If they can provide more information and a reproducer that works on a
kernel from Linus' tree we can take a look, but as things currently
stand I think this may be due to a wonky Android/Huawei kernel.
* https://lore.kernel.org/linux-audit/1587536907-63272-1-git-send-email-guyiwen@huawei.com
> > What kernel are you using? Is this an Android kernel?
> >
> > Do you have a reproducer you can share?
--
paul moore
www.paul-moore.com
--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit
prev parent reply other threads:[~2020-05-27 13:24 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-05-25 7:21 [RFC] audit: allow audit_reusename to check kernel path Yiwen Gu
2020-05-25 7:21 ` [PATCH] " Yiwen Gu
2020-05-26 12:32 ` [RFC] " Paul Moore
2020-05-27 0:36 ` Alexander Viro
2020-05-27 13:23 ` Paul Moore [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAHC9VhQW+zt7zEkLNT4rv7_sQOmC1NUq8Mh=5Xs5RZwcWLFcVg@mail.gmail.com' \
--to=paul@paul-moore.com \
--cc=aviro@redhat.com \
--cc=linux-audit@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).