Paul Moore f26d043313 audit: improve audit queue handling when "audit=1" on cmdline ... When an admin enables audit at early boot via the "audit=1" kernel command line the audit queue behavior is slightly different; the audit subsystem goes to greater lengths to avoid dropping records, which unfortunately can result in problems when the audit daemon is forcibly stopped for an extended period of time. This patch makes a number of changes designed to improve the audit queuing behavior so that leaving the audit daemon in a stopped state for an extended period does not cause a significant impact to the system. - kauditd_send_queue() is now limited to looping through the passed queue only once per call. This not only prevents the function from looping indefinitely when records are returned to the current queue, it also allows any recovery handling in kauditd_thread() to take place when kauditd_send_queue() returns. - Transient netlink send errors seen as -EAGAIN now cause the record to be returned to the retry queue instead of going to the hold queue. The intention of the hold queue is to store, perhaps for an extended period of time, the events which led up to the audit daemon going offline. The retry queue remains a temporary queue intended to protect against transient issues between the kernel and the audit daemon. - The retry queue is now limited by the audit_backlog_limit setting, the same as the other queues. This allows admins to bound the size of all of the audit queues on the system. - kauditd_rehold_skb() now returns records to the end of the hold queue to ensure ordering is preserved in the face of recent changes to kauditd_send_queue(). Cc: stable@vger.kernel.org Fixes: 5b52330bbf ("audit: fix auditd/kernel connection state tracking") Fixes: f4b3ee3c85 ("audit: improve robustness of the audit queue handling") Reported-by: Gaosheng Cui <cuigaosheng1@huawei.com> Tested-by: Gaosheng Cui <cuigaosheng1@huawei.com> Reviewed-by: Richard Guy Briggs <rgb@redhat.com> Signed-off-by: Paul Moore <paul@paul-moore.com>		2022-01-25 13:22:51 -05:00
..
bpf
cgroup
configs	configs: introduce debug.config for CI-like setup	2022-01-20 08:52:55 +02:00
debug
dma
entry
events
futex
gcov
irq	proc: remove PDE_DATA() completely	2022-01-22 08:33:37 +02:00
kcsan
livepatch
locking	locking/rwlocks: introduce write_lock_nested	2022-01-22 08:33:37 +02:00
power
printk	printk: fix build warning when CONFIG_PRINTK=n	2022-01-22 08:33:36 +02:00
rcu
sched
time	bitmap patches for 5.17-rc1	2022-01-23 06:20:44 +02:00
trace	ftrace: Fix s390 breakage from sorting mcount tables	2022-01-23 08:07:02 +02:00
.gitignore
acct.c
async.c
audit.c	audit: improve audit queue handling when "audit=1" on cmdline	2022-01-25 13:22:51 -05:00
audit.h
audit_fsnotify.c
audit_tree.c
audit_watch.c
auditfilter.c
auditsc.c	lsm: security_task_getsecid_subj() -> security_current_getsecid_subj()	2021-11-22 17:52:47 -05:00
backtracetest.c
bounds.c
capability.c
cfi.c
compat.c
configs.c
context_tracking.c
cpu.c
cpu_pm.c
crash_core.c
crash_dump.c
cred.c
delayacct.c	delayacct: track delays from memory compact	2022-01-20 08:52:55 +02:00
dma.c
exec_domain.c
exit.c
extable.c
fail_function.c
fork.c
freezer.c
gen_kheaders.sh
groups.c
hung_task.c	hung_task: move hung_task sysctl interface to hung_task.c	2022-01-22 08:33:34 +02:00
iomem.c
irq_work.c
jump_label.c
kallsyms.c
kcmp.c
Kconfig.freezer
Kconfig.hz
Kconfig.locks
Kconfig.preempt
kcov.c
kexec.c
kexec_core.c
kexec_elf.c
kexec_file.c
kexec_internal.h
kheaders.c
kmod.c
kprobes.c	kprobe: move sysctl_kprobes_optimization to kprobes.c	2022-01-22 08:33:36 +02:00
ksysfs.c
kthread.c	Merge branch 'akpm' (patches from Andrew)	2022-01-20 10:41:01 +02:00
latencytop.c
Makefile
module-internal.h
module.c
module_decompress.c
module_signature.c
module_signing.c
notifier.c
nsproxy.c
padata.c
panic.c	panic: remove oops_id	2022-01-20 08:52:55 +02:00
params.c
pid.c
pid_namespace.c
profile.c
ptrace.c
range.c
reboot.c
regset.c
relay.c
resource.c	proc: remove PDE_DATA() completely	2022-01-22 08:33:37 +02:00
resource_kunit.c
rseq.c
scftorture.c
scs.c
seccomp.c
signal.c
smp.c
smpboot.c
smpboot.h
softirq.c
stackleak.c	stackleak: move stack_erasing sysctl to stackleak.c	2022-01-22 08:33:35 +02:00
stacktrace.c
static_call.c
stop_machine.c
sys.c	Merge branch 'akpm' (patches from Andrew)	2022-01-20 10:41:01 +02:00
sys_ni.c
sysctl-test.c
sysctl.c	sysctl: returns -EINVAL when a negative value is passed to proc_doulongvec_minmax	2022-01-22 08:33:37 +02:00
task_work.c
taskstats.c
torture.c
tracepoint.c
tsacct.c
ucount.c
uid16.c
uid16.h
umh.c
up.c
user-return-notifier.c
user.c
user_namespace.c
usermode_driver.c
utsname.c
utsname_sysctl.c
watch_queue.c
watchdog.c	watchdog: move watchdog sysctl interface to watchdog.c	2022-01-22 08:33:34 +02:00
watchdog_hld.c
workqueue.c
workqueue_internal.h