search

linux-audit / audit-kernel

GitHub mirror of the Linux Kernel's audit repository
https://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit.git
Other
140 stars 37 forks source link

RFE: investigate moving to a more general audit buffer cache #29

Closed pcmoore closed 7 years ago

pcmoore commented 7 years ago

We keep a cache of audit buffers that is implemented as a simple list maintained by the audit subsystem, we really should look into leveraging the existing kernel mechanisms and not using our own caching mechanism.

Possible solutions include a straight removal of the cache and reliance on the SLUB cache as well as the creation of an audit buffer specific kmem_cache.

pcmoore commented 7 years ago

Patch from Florian Westphal to remove the audit maintained buffer list:

pcmoore commented 7 years ago

Upstream RFC patch: https://www.redhat.com/archives/linux-audit/2017-March/msg00120.html

pcmoore commented 7 years ago

Resolved in the following commit:

commit 4acdad9bab28337530293b15c4ded8fbffdecb65
Author: Paul Moore <paul@paul-moore.com>
Date:   Tue Apr 11 15:38:38 2017 -0400

audit: use kmem_cache to manage the audit_buffer cache

The audit subsystem implemented its own buffer cache mechanism which
is a bit silly these days when we could use the kmem_cache construct.

Some credit is due to Florian Westphal for originally proposing that
we remove the audit cache implementation in favor of simple
kmalloc()/kfree() calls, but I would rather have a dedicated slab
cache to ease debugging and future stats/performance work.

Cc: Florian Westphal <fw@strlen.de>
Reviewed-by: Richard Guy Briggs <rgb@redhat.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>