1. 01 Mar, 2008 5 commits
    • Steve Grubb's avatar
      [PATCH] drop EOE records from printk · 8d07a67c
      Steve Grubb authored
      Hi,
      
      While we are looking at the printk issue, I see that its printk'ing the EOE
      (end of event) records which is really not something that we need in syslog.
      Its really intended for the realtime audit event stream handled by the audit
      daemon. So, lets avoid printk'ing that record type.
      Signed-off-by: default avatarSteve Grubb <sgrubb@redhat.com>
      Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      8d07a67c
    • Eric Paris's avatar
      [RFC] AUDIT: do not panic when printk loses messages · b29ee87e
      Eric Paris authored
      On the latest kernels if one was to load about 15 rules, set the failure
      state to panic, and then run service auditd stop the kernel will panic.
      This is because auditd stops, then the script deletes all of the rules.
      These deletions are sent as audit messages out of the printk kernel
      interface which is already known to be lossy.  These will overun the
      default kernel rate limiting (10 really fast messages) and will call
      audit_panic().  The same effect can happen if a slew of avc's come
      through while auditd is stopped.
      
      This can be fixed a number of ways but this patch fixes the problem by
      just not panicing if auditd is not running.  We know printk is lossy and
      if the user chooses to set the failure mode to panic and tries to use
      printk we can't make any promises no matter how hard we try, so why try?
      At least in this way we continue to get lost message accounting and will
      eventually know that things went bad.
      
      The other change is to add a new call to audit_log_lost() if auditd
      disappears.  We already pulled the skb off the queue and couldn't send
      it so that message is lost.  At least this way we will account for the
      last message and panic if the machine is configured to panic.  This code
      path should only be run if auditd dies for unforeseen reasons.  If
      auditd closes correctly audit_pid will get set to 0 and we won't walk
      this code path.
      Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      b29ee87e
    • Paul Moore's avatar
      [PATCH] Audit: Fix the format type for size_t variables · 422b03cf
      Paul Moore authored
      Fix the following compiler warning by using "%zu" as defined in C99.
      
        CC      kernel/auditsc.o
        kernel/auditsc.c: In function 'audit_log_single_execve_arg':
        kernel/auditsc.c:1074: warning: format '%ld' expects type 'long int', but
        argument 4 has type 'size_t'
      Signed-off-by: default avatarPaul Moore <paul.moore@hp.com>
      Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      422b03cf
    • Linus Torvalds's avatar
      Merge branch 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/libata-dev · d395991c
      Linus Torvalds authored
      * 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/libata-dev:
        [libata] wrap kmap_atomic(KM_IRQ0) with local_irq_save/restore()
        sata_svw: Add support for HT1100 SATA controller
      d395991c
    • Jeff Garzik's avatar
      [libata] wrap kmap_atomic(KM_IRQ0) with local_irq_save/restore() · b445c568
      Jeff Garzik authored
      Interrupts must be disabled if using kmap_atomic(KM_IRQ0), but that was
      not the case in a few code paths coming directly from ATA driver
      interrupt handlers (which use spin_lock rather than spin_lock_irqsave).
      Signed-off-by: default avatarJeff Garzik <jgarzik@redhat.com>
      b445c568
  2. 29 Feb, 2008 35 commits