Messages in this thread | | | Date | Fri, 20 May 2005 10:19:06 -0700 | From | Chris Wright <> | Subject | Re: 2.6.12-rc4-mm2 - sleeping function called from invalid context at mm/slab.c:2502 |
| |
* Stephen Smalley (sds@tycho.nsa.gov) wrote: > On Fri, 2005-05-20 at 10:01 -0700, Chris Wright wrote: > > > +struct audit_aux_data_avc { > > > > I guess it's not really avc specific (although it's primary user). > > You mean generalize the struct for possible re-use by other audit > helpers but keep the type value and function distinct? > audit_aux_data_path? Analogous to struct path in namei.c.
Yup.
> > Won't this change the order quite a bit? And how do you correlate path > > vs. exe, etc.? Oh, I see, you're not using it for exe... > > Could be an issue for syscalls that involve multiple files, e.g. rename. > We are at least still logging the last component name, device, and inode > number with the avc message, and only deferring logging of the full > pathname.
If it works for you, it's really only effecting your messages at this point. I took David's idea to mean replace audit_log_d_path altogether, and all paths logged on exit with aux data.
thanks, -chris - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |