github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-10-22 23:01:49 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

audit: separate file and process capability storage

Browse Source 
File capabilities need permitted and inheritable sets, an effective flag,
and a root UID. Process capabilities need four full capability sets but
neither a file effective flag nor a root UID. Give file capabilities their
own type instead of storing both representations in audit_cap_data.

This reduces each preallocated audit_names entry by 16 bytes on the tested
64-bit configurations, saving 80 bytes per audit context. The BPRM
capability auxiliary object also shrinks from 144 to 112 bytes. Retain all
logged fields, including file root IDs and process ambient capabilities;
record formats and collection behavior are unchanged.

Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
This commit is contained in:
Christian Göttsche 2026-09-17 16:39:45 +02:00 committed by Paul Moore
parent ca12826b4a
commit a8bdcf9445
2 changed files with 10 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
kernel/audit.h
View File

@ -53,15 +53,18 @@ struct audit_entry {
struct audit_krule rule;
};
struct audit_file_caps {
kernel_cap_t permitted;
kernel_cap_t inheritable;
unsigned int fE; /* effective bit of file cap */
kuid_t rootid;
};
struct audit_cap_data {
kernel_cap_t permitted;
kernel_cap_t inheritable;
union {
unsigned int fE; /* effective bit of file cap */
kernel_cap_t effective; /* effective set of process */
};
kernel_cap_t effective;
kernel_cap_t ambient;
kuid_t rootid;
};
/* When fs/namei.c:getname() is called, we store the pointer in name and bump
@ -83,7 +86,7 @@ struct audit_names {
kgid_t gid;
dev_t rdev;
struct lsm_prop oprop;
struct audit_cap_data fcap;
struct audit_file_caps fcap;
unsigned int fcap_ver;
unsigned char type; /* record type */
/*

2
kernel/auditsc.c
View File

@ -107,7 +107,7 @@ struct audit_aux_data_pids {
struct audit_aux_data_bprm_fcaps {
struct audit_aux_data d;
struct audit_cap_data fcap;
struct audit_file_caps fcap;
unsigned int fcap_ver;
struct audit_cap_data old_pcap;
struct audit_cap_data new_pcap;