From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751796AbcFJBoX (ORCPT ); Thu, 9 Jun 2016 21:44:23 -0400 Received: from mx1.redhat.com ([209.132.183.28]:56676 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750772AbcFJBoV (ORCPT ); Thu, 9 Jun 2016 21:44:21 -0400 Date: Thu, 9 Jun 2016 21:44:17 -0400 From: Richard Guy Briggs To: Steve Grubb Cc: Arnd Bergmann , y2038@lists.linaro.org, linux-kernel@vger.kernel.org, linux-audit@redhat.com, Al Viro , linux-fsdevel@vger.kernel.org, Thomas Gleixner , Linus Torvalds , Deepa Dinamani Subject: Re: [PATCH 17/21] audit: Use timespec64 to represent audit timestamps Message-ID: <20160610014417.GN18488@madcap2.tricolour.ca> References: <1465448705-25055-1-git-send-email-deepa.kernel@gmail.com> <15760445.1IAucOxmWy@x2> <20160609235943.GL18488@madcap2.tricolour.ca> <1850599.zs4hA4SSlr@x2> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1850599.zs4hA4SSlr@x2> User-Agent: Mutt/1.5.21 (2010-09-15) X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.32]); Fri, 10 Jun 2016 01:44:21 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 16/06/09, Steve Grubb wrote: > On Thursday, June 09, 2016 07:59:43 PM Richard Guy Briggs wrote: > > On 16/06/09, Steve Grubb wrote: > > > On Wednesday, June 08, 2016 10:05:01 PM Deepa Dinamani wrote: > > > > struct timespec is not y2038 safe. > > > > Audit timestamps are recorded in string format into > > > > an audit buffer for a given context. > > > > These mark the entry timestamps for the syscalls. > > > > Use y2038 safe struct timespec64 to represent the times. > > > > The log strings can handle this transition as strings can > > > > hold upto 1024 characters. > > > > > > Have you tested this with ausearch or any audit utilities? As an aside, a > > > time stamp that is up to 1024 characters long is terribly wasteful > > > considering how many events we get. > > > > Steve, > > > > I don't expect the size of the time stamp text to change since the > > format isn't being changed and I don't expect the date stamp text length > > to change until Y10K, but you never know what will happen in 8 > > millenia... (Who knows, maybe that damn Linux server in my basement > > will still be running then...) > > > > Isn't the maximum message length MAX_AUDIT_MESSAGE_LENGTH (8970 octets)? > > Bytes, yes. But I was thinking that if its going to get big we should consider > switching from a base 10 representation to base 16. That would give us back a > few bytes. We discuss this on the linux-audit list rather than the main list. This seems like a false economy to me. If I understand correctly, it will be 285 years before we roll the next text digit. The next binary digit in the internal kernel format is in 22 years. I know there have been discussions about changing to a binary format, which seems to have a lot more to offer than breaking the current format for a few bytes. Is this not the linux-audit main list? Is there another one I am missing? > -Steve - RGB -- Richard Guy Briggs Kernel Security Engineering, Base Operating Systems, Red Hat Remote, Ottawa, Canada Voice: +1.647.777.2635, Internal: (81) 32635