Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1254109

[RFC PATCH 6/7] audit: wake up audit_backlog_wait queue when auditd goes away.

Show all headers | View raw

When auditd goes away (died, killed or shutdown, or net namespace shut
down), there is no point in sleeping waiting for auditd to drain the
queue since that message would be distined for the hold queue after the
timeout anyways.  This will needlessly have those processes wait the
full default timeout of 60 seconds (audit_backlog_wait_time).

Wake up the processes caught in the audit_backlog_wait queue when auditd
is no longer present so they can be sent instead to the hold queue.

Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
---
 kernel/audit.c |    6 +++++-
 1 files changed, 5 insertions(+), 1 deletions(-)

diff --git a/kernel/audit.c b/kernel/audit.c
index 34411af..688fa1e 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -425,6 +425,7 @@ restart:
 				audit_log_lost(s);
 				audit_pid = 0;
 				audit_sock = NULL;
+				wake_up(&audit_backlog_wait);
 			} else {
 				pr_warn("re-scheduling(#%d) write to audit_pid=%d\n",
 					attempts, audit_pid);
@@ -882,6 +883,8 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
 			audit_pid = new_pid;
 			audit_nlk_portid = NETLINK_CB(skb).portid;
 			audit_sock = skb->sk;
+			if (!audit_pid)
+				wake_up(&audit_backlog_wait);
 		}
 		if (s.mask & AUDIT_STATUS_RATE_LIMIT) {
 			err = audit_set_rate_limit(s.rate_limit);
@@ -1154,6 +1157,7 @@ static void __net_exit audit_net_exit(struct net *net)
 	if (sock == audit_sock) {
 		audit_pid = 0;
 		audit_sock = NULL;
+		wake_up(&audit_backlog_wait);
 	}
 
 	RCU_INIT_POINTER(aunet->nlsk, NULL);
@@ -1393,7 +1397,7 @@ struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask,
 			sleep_time = timeout_start + audit_backlog_wait_time - jiffies;
 			if (sleep_time > 0) {
 				sleep_time = wait_for_auditd(sleep_time);
-				if (sleep_time > 0)
+				if (audit_pid && sleep_time > 0)
 					continue;
 			}
 		}
-- 
1.7.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[RFC PATCH 0/7] audit: clean up audit queue handling Richard Guy Briggs <rgb@redhat.com> - 2015-10-22 21:00 +0200
  [RFC PATCH 2/7] audit: include auditd's threads in audit_log_start() wait exception Richard Guy Briggs <rgb@redhat.com> - 2015-10-22 21:00 +0200
  [RFC PATCH 1/7] audit: don't needlessly reset valid wait time Richard Guy Briggs <rgb@redhat.com> - 2015-10-22 21:00 +0200
  [RFC PATCH 4/7] audit: wake up threads if queue switched from limited to unlimited Richard Guy Briggs <rgb@redhat.com> - 2015-10-22 21:00 +0200
  [RFC PATCH 6/7] audit: wake up audit_backlog_wait queue when auditd goes away. Richard Guy Briggs <rgb@redhat.com> - 2015-10-22 21:00 +0200
  [RFC PATCH 7/7] audit: wake up kauditd_thread after auditd registers Richard Guy Briggs <rgb@redhat.com> - 2015-10-22 21:00 +0200
  [RFC PATCH 3/7] audit: allow systemd to use queue reserves Richard Guy Briggs <rgb@redhat.com> - 2015-10-22 21:00 +0200
  [RFC PATCH 5/7] audit: allow audit_cmd_mutex holders to use reserves Richard Guy Briggs <rgb@redhat.com> - 2015-10-22 21:00 +0200
  Re: [RFC PATCH 0/7] audit: clean up audit queue handling Paul Moore <pmoore@redhat.com> - 2015-10-27 19:50 +0100
    Re: [RFC PATCH 0/7] audit: clean up audit queue handling Richard Guy Briggs <rgb@redhat.com> - 2015-10-28 19:50 +0100
      Re: [RFC PATCH 0/7] audit: clean up audit queue handling Paul Moore <pmoore@redhat.com> - 2015-10-28 20:00 +0100

csiph-web