[PATCH V2] audit: shorten PATH cap values when zero

Paul Moore paul at paul-moore.com
Tue Dec 4 00:29:34 UTC 2018


On Fri, Nov 30, 2018 at 4:13 PM Richard Guy Briggs <rgb at redhat.com> wrote:
>
> Since the vast majority of files (99.993% on a typical system) have no
> fcaps, display "0" instead of the full zero-padded 16 hex digits in the
> two PATH record cap_f* fields to save netlink bandwidth and disk space.
>
> Simply changing the format to %x won't work since the value is two (or
> possibly more in the future) 32-bit hexadecimal values concatenated and
> bits in higher order values will be misrepresented.
>
> Passes audit-testsuite and userspace tools already work fine.
> Please see the github issue tracker for more details
> https://github.com/linux-audit/audit-kernel/issues/101
>
> Signed-off-by: Richard Guy Briggs <rgb at redhat.com>
> Acked-by: Steve Grubb <sgrubb at redhat.com>
> ---
> Changelog:
> v2:
> - switch to cap_isclear() and condense logic
>
>  kernel/audit.c | 10 ++++++----
>  1 file changed, 6 insertions(+), 4 deletions(-)

Merged into audit/next.  Thanks.

> diff --git a/kernel/audit.c b/kernel/audit.c
> index 2a8058764aa6..55b2079145dc 100644
> --- a/kernel/audit.c
> +++ b/kernel/audit.c
> @@ -2058,11 +2058,13 @@ void audit_log_cap(struct audit_buffer *ab, char *prefix, kernel_cap_t *cap)
>  {
>         int i;
>
> -       audit_log_format(ab, " %s=", prefix);
> -       CAP_FOR_EACH_U32(i) {
> -               audit_log_format(ab, "%08x",
> -                                cap->cap[CAP_LAST_U32 - i]);
> +       if (cap_isclear(*cap)) {
> +               audit_log_format(ab, " %s=0", prefix);
> +               return;
>         }
> +       audit_log_format(ab, " %s=", prefix);
> +       CAP_FOR_EACH_U32(i)
> +               audit_log_format(ab, "%08x", cap->cap[CAP_LAST_U32 - i]);
>  }
>
>  static void audit_log_fcaps(struct audit_buffer *ab, struct audit_names *name)
> --
> 1.8.3.1
>


-- 
paul moore
www.paul-moore.com




More information about the Linux-audit mailing list