The race was non existent. I had the VMA locked. I switched = to this to keep the code that gets the cmdline value almost unchanged to tr= y and reduce bugs. I can still author a patch on top of this later to optim= ize. However the buffer is smaller. Before it was page size, now its path m= ax....iirc is smaller.

On Jan 14, 2014 5:45 PM, "Richard Guy Brigg= s" <rgb@redhat.com> wrote:=

On 14/01/06, William Roberts wrote:
> During an audit event, cache and print the value of the process's<= br> > cmdline value (proc/<pid>/cmdline). This is useful in situations=
> where processes are started via fork'd virtual machines where the<= br> > comm field is incorrect. Often times, setting the comm field still
> is insufficient as the comm width is not very wide and most
> virtual machine "package names" do not fit. Also, during exe= cution,
> many threads have their comm field set as well. By tying it back to > the global cmdline value for the process, audit records will be more > complete in systems with these properties. An example of where this > is useful and applicable is in the realm of Android. With Android,
> their is no fork/exec for VM instances. The bare, preloaded Dalvik
> VM listens for a fork and specialize request. When this request comes<= br> > in, the VM forks, and the loads the specific application (specializing= ).
> This was done to take advantage of COW and to not require a load of > basic packages by the VM on very app spawn. When this spawn occurs, > the package name is set via setproctitle() and shows up in procfs.
> Many of these package names are longer then 16 bytes, the historical > width of task->comm. Having the cmdline in the audit records will > couple the application back to the record directly. Also, on my
> Debian development box, some audit records were more useful then
> what was printed under comm.

So... =A0What happenned to allocating only what you need instead of the
full 4k buffer? =A0Your test results showed promise with only 64 or 128
bytes allocated. =A0I recall seeing some discussion about a race between testing for the size needed and actually filling the buffer, but was
hoping that would be worked on rather than reverting back to the full
4k.

> The cached cmdline is tied to the life-cycle of the audit_context
> structure and is built on demand.
>
> Example denial prior to patch (Ubuntu):
> CALL msg=3Daudit(1387828084.070:361): arch=3Dc000003e syscall=3D82 suc= cess=3Dyes exit=3D0 a0=3D4184bf a1=3D418547 a2=3D0 a3=3D0 items=3D0 ppid=3D= 1 pid=3D1329 auid=3D4294967295 uid=3D0 gid=3D0 euid=3D0 suid=3D0 fsuid=3D0 = egid=3D0 sgid=3D0 fsgid=3D0 ses=3D4294967295 tty=3D(none) comm=3D"cons= ole-kit-dae" exe=3D"/usr/sbin/console-kit-daemon" subj=3Dsys= tem_u:system_r:consolekit_t:s0-s0:c0.c255 key=3D(null)
>
> After Patches (Ubuntu):
> type=3DSYSCALL msg=3Daudit(1387828084.070:361): arch=3Dc000003e syscal= l=3D82 success=3Dyes exit=3D0 a0=3D4184bf a1=3D418547 a2=3D0 a3=3D0 items= =3D0 ppid=3D1 pid=3D1329 auid=3D4294967295 uid=3D0 gid=3D0 euid=3D0 suid=3D= 0 fsuid=3D0 egid=3D0 sgid=3D0 fsgid=3D0 ses=3D4294967295 tty=3D(none) comm= =3D"console-kit-dae" exe=3D"/usr/sbin/console-kit-daemon&quo= t; subj=3Dsystem_u:system_r:consolekit_t:s0-s0:c0.c255 cmdline=3D"/usr= /lib/dbus-1.0/dbus-daemon-launch-helper" key=3D(null)
>
> Example denial prior to patch (Android):
> type=3D1300 msg=3Daudit(248323.940:247): arch=3D40000028 syscall=3D54 = per=3D840000 success=3Dyes exit=3D0 a0=3D39 a1=3D540b a2=3D2 a3=3D750eecec = items=3D0 ppid=3D224 pid=3D1858 auid=3D4294967295 uid=3D1002 gid=3D1002 eui= d=3D1002 suid=3D1002 fsuid=3D1002 egid=3D1002 sgid=3D1002 fsgid=3D1002 tty= =3D(none) ses=3D4294967295 comm=3D"bt_hc_worker" exe=3D"/sys= tem/bin/app_process" subj=3Du:r:bluetooth:s0 key=3D(null)
>
> After Patches (Android):
> type=3D1300 msg=3Daudit(248323.940:247): arch=3D40000028 syscall=3D54 = per=3D840000 success=3Dyes exit=3D0 a0=3D39 a1=3D540b a2=3D2 a3=3D750eecec = items=3D0 ppid=3D224 pid=3D1858 auid=3D4294967295 uid=3D1002 gid=3D1002 eui= d=3D1002 suid=3D1002 fsuid=3D1002 egid=3D1002 sgid=3D1002 fsgid=3D1002 tty= =3D(none) ses=3D4294967295 comm=3D"bt_hc_worker" exe=3D"/sys= tem/bin/app_process" cmdline=3D"com.android.bluetooth" subj= =3Du:r:bluetooth:s0 key=3D(null)
>
> Signed-off-by: William Roberts <wroberts@tresys.com>
> ---
> =A0kernel/audit.h =A0 | =A0 =A01 +
> =A0kernel/auditsc.c | =A0 32 ++++++++++++++++++++++++++++++++
> =A02 files changed, 33 insertions(+)
>
> diff --git a/kernel/audit.h b/kernel/audit.h
> index b779642..bd6211f 100644
> --- a/kernel/audit.h
> +++ b/kernel/audit.h
> @@ -202,6 +202,7 @@ struct audit_context {
> =A0 =A0 =A0 =A0 =A0 =A0 =A0 } execve;
> =A0 =A0 =A0 };
> =A0 =A0 =A0 int fds[2];
> + =A0 =A0 char *cmdline;
>
> =A0#if AUDIT_DEBUG
> =A0 =A0 =A0 int =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 put_count;
> diff --git a/kernel/auditsc.c b/kernel/auditsc.c
> index 90594c9..a4c2003 100644
> --- a/kernel/auditsc.c
> +++ b/kernel/auditsc.c
> @@ -842,6 +842,12 @@ static inline struct audit_context *audit_get_con= text(struct task_struct *tsk,
> =A0 =A0 =A0 return context;
> =A0}
>
> +static inline void audit_cmdline_free(struct audit_context *context)<= br> > +{
> + =A0 =A0 kfree(context->cmdline);
> + =A0 =A0 context->cmdline =3D NULL;
> +}
> +
> =A0static inline void audit_free_names(struct audit_context *context)<= br> > =A0{
> =A0 =A0 =A0 struct audit_names *n, *next;
> @@ -955,6 +961,7 @@ static inline void audit_free_context(struct audit= _context *context)
> =A0 =A0 =A0 audit_free_aux(context);
> =A0 =A0 =A0 kfree(context->filterkey);
> =A0 =A0 =A0 kfree(context->sockaddr);
> + =A0 =A0 audit_cmdline_free(context);
> =A0 =A0 =A0 kfree(context);
> =A0}
>
> @@ -1271,6 +1278,30 @@ static void show_special(struct audit_context *= context, int *call_panic)
> =A0 =A0 =A0 audit_log_end(ab);
> =A0}
>
> +static void audit_log_cmdline(struct audit_buffer *ab, struct task_st= ruct *tsk,
> + =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0struct audit_context *con= text)
> +{
> + =A0 =A0 int res;
> + =A0 =A0 char *buf;
> + =A0 =A0 char *msg =3D "(null)";
> + =A0 =A0 audit_log_format(ab, " cmdline=3D");
> +
> + =A0 =A0 /* Not =A0cached */
> + =A0 =A0 if (!context->cmdline) {
> + =A0 =A0 =A0 =A0 =A0 =A0 buf =3D kmalloc(PATH_MAX, GFP_KERNEL);
> + =A0 =A0 =A0 =A0 =A0 =A0 if (!buf)
> + =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 goto out;
> + =A0 =A0 =A0 =A0 =A0 =A0 res =3D get_cmdline(tsk, buf, PATH_MAX);
> + =A0 =A0 =A0 =A0 =A0 =A0 /* Ensure NULL terminated */
> + =A0 =A0 =A0 =A0 =A0 =A0 if (buf[res-1] !=3D '\0')
> + =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 buf[res-1] =3D '\0';=
> + =A0 =A0 =A0 =A0 =A0 =A0 context->cmdline =3D buf;
> + =A0 =A0 }
> + =A0 =A0 msg =3D context->cmdline;
> +out:
> + =A0 =A0 audit_log_untrustedstring(ab, msg);
> +}
> +
> =A0static void audit_log_exit(struct audit_context *context, struct ta= sk_struct *tsk)
> =A0{
> =A0 =A0 =A0 int i, call_panic =3D 0;
> @@ -1302,6 +1333,7 @@ static void audit_log_exit(struct audit_context = *context, struct task_struct *ts
> =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0context->name_count)= ;
>
> =A0 =A0 =A0 audit_log_task_info(ab, tsk);
> + =A0 =A0 audit_log_cmdline(ab, tsk, context);
> =A0 =A0 =A0 audit_log_key(ab, context->filterkey);
> =A0 =A0 =A0 audit_log_end(ab);
>
> --
> 1.7.9.5
>
> --
> Linux-audit mailing list
> Linux-audit@redhat.com > https://www.redhat.com/mailman/listinfo/linux-audit

- RGB

--
Richard Guy Briggs <rbriggs@redhat= .com>
Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems,= Red Hat
Remote, Ottawa, Canada
Voice: +1.647.777.= 2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545