Messages in this thread | | | From | Dmitry Vyukov <> | Date | Tue, 14 Dec 2021 12:42:55 +0100 | Subject | Re: [PATCH] tomoyo: Check exceeded quota early in tomoyo_domain_quota_is_ok(). |
| |
On Tue, 14 Dec 2021 at 12:36, Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp> wrote: > > On 2021/12/14 18:45, Dmitry Vyukov wrote: > > If tomoyo is used in a testing/fuzzing environment in learning mode, > > for lots of domains the quota will be exceeded and stay exceeded > > for prolonged periods of time. In such cases it's pointless (and slow) > > to walk the whole acl list again and again just to rediscover that > > the quota is exceeded. We already have the TOMOYO_DIF_QUOTA_WARNED flag > > that notes the overflow condition. Check it early to avoid the slowdown. > > Thank you. > > This patch will make a slight but user visible change. > > When tomoyo_profile(domain->ns, domain->profile)->pref[TOMOYO_PREF_MAX_LEARNING_ENTRY] is > increased (or domain->profile switches to a different profile which has larger > pref[TOMOYO_PREF_MAX_LEARNING_ENTRY] value) after domain->flags[TOMOYO_DIF_QUOTA_WARNED] = true > is called, tomoyo_domain_quota_is_ok() will continue returning "false", and ACLs are no longer > appended. > > Therefore, administrator will have to manually do domain->flags[TOMOYO_DIF_QUOTA_WARNED] = false > after increasing pref[TOMOYO_PREF_MAX_LEARNING_ENTRY] value (or changing domain->profile). > > But since the message > > WARNING: Domain '%s' has too many ACLs to hold. Stopped learning mode. > > is a hint that tells administrator that "you will surely fail to try the enforcing mode on this > domain because the kernel has failed to automatically append at least one ACL to this domain", > administrator would have to retry the learning mode after increasing > pref[TOMOYO_PREF_MAX_LEARNING_ENTRY] value (or changing domain->profile) even without this patch. > > Therefore, asking administrator to also clear domain->flags[TOMOYO_DIF_QUOTA_WARNED] after > increasing pref[TOMOYO_PREF_MAX_LEARNING_ENTRY] value (or changing domain->profile) would be > tolerable...
Should we reset flags[TOMOYO_DIF_QUOTA_WARNED] on any writes that change TOMOYO_PREF_MAX_LEARNING_ENTRY?
If I am increasing TOMOYO_PREF_MAX_LEARNING_ENTRY because I observed the warning, it's useful for me to receive the warning again.
| |