Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   Chris Mason <clm@fb.com>
To:     Paul Moore <paul@paul-moore.com>
CC:     Eric Paris <eparis@redhat.com>,
        Dave Jones <davej@codemonkey.org.uk>,
        "linux-audit@redhat.com" <linux-audit@redhat.com>,
        Kyle McMartin <jkkm@fb.com>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH] audit: set context->dummy even when audit is off
Thread-Topic: [PATCH] audit: set context->dummy even when audit is off
Thread-Index: AQHVkAncrhonQVVxy06vYxt2pY3gVKd1ZVQAgACm2QCABbABgIAABqgA
Date:   Tue, 5 Nov 2019 00:39:21 +0000
Message-ID: <5E08422A-BFE2-4515-A804-3DB42B7D8550@fb.com>
References: <CAHC9VhTyz7fd+iQaymVXUGFe3ZA5Z_WkJeY_snDYiZ9GP6gCOA@mail.gmail.com>
 <20191031163931.1102669-1-clm@fb.com>
 <CAHC9VhRwRSGa5JSL0=cXxG-oOg9jUve9OEYyTCqTxzr=aMdGxg@mail.gmail.com>
 <B63048C4-3158-453B-859A-C5574AACDC36@fb.com>
 <CAHC9VhR92Ade8_d1UnTy4_hJDxmwZPU31eubnrq=ejPBjkTS4w@mail.gmail.com>
In-Reply-To: <CAHC9VhR92Ade8_d1UnTy4_hJDxmwZPU31eubnrq=ejPBjkTS4w@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-messagesentrepresentingtype: 1
x-originating-ip: [2620:10d:c091:480::5e73]
x-ms-publictraffictype: Email
x-ms-office365-filtering-correlation-id: 83541d98-df51-4afb-3f92-08d76188997c
x-ms-traffictypediagnostic: SN6PR15MB2494:
x-ms-exchange-transport-forked: True
x-microsoft-antispam-prvs: <SN6PR15MB2494D10E05519E3534A136CED37E0@SN6PR15MB2494.namprd15.prod.outlook.com>
x-ms-oob-tlc-oobclassifiers: OLM:8273;
x-forefront-prvs: 0212BDE3BE
x-forefront-antispam-report: SFV:NSPM;SFS:(10019020)(136003)(39860400002)(366004)(396003)(376002)(346002)(199004)(189003)(51914003)(14454004)(33656002)(66946007)(6436002)(66446008)(64756008)(7736002)(2906002)(5660300002)(478600001)(25786009)(305945005)(54906003)(86362001)(316002)(81166006)(186003)(476003)(8676002)(81156014)(11346002)(486006)(36756003)(6116002)(50226002)(8936002)(446003)(76176011)(102836004)(52116002)(99286004)(6506007)(6916009)(2616005)(6512007)(4326008)(229853002)(71200400001)(71190400001)(66476007)(386003)(256004)(14444005)(66556008)(46003)(53546011)(6246003)(6486002);DIR:OUT;SFP:1102;SCL:1;SRVR:SN6PR15MB2494;H:SN6PR15MB2446.namprd15.prod.outlook.com;FPR:;SPF:None;LANG:en;PTR:InfoNoRecords;A:1;MX:1;
received-spf: None (protection.outlook.com: fb.com does not designate
 permitted sender hosts)
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info: XGCMiCYhSIdeal55YyRSzMoEQyBB/06Uvw8qAVLa5S9lKskHZaXglS4ru0xUcYR4gNhO0IUD4ofzyVClLeatBifrcX58agFe6TrKuvmQL8/L/j2Pg/ihFKqjh7Wenio5fkevmB+rw59VN9/ztdHPkFCkIyANa8/7NbpwRVKT1i9VT0VrQ2m+kd22k/2/N9GbGUD9njj/085R/WbbEJCcc22EHx8WIMT/c89rdrHZhwubTwDKjHLaoDZdJDtvYTg53Gq1Ugtf/SUzQBvceVZp/w0ZV/CDvoEIyVzELxBwpQQMHx8SftnJMfKxHA93equJOWOJd1y0pG7z/MmASjRt1TfYuycXxFIx2P8c8IMnDZA6v29IFZsfHL4AMcHkwQy3jhZOKlApSPuXEBdao9TkHOzlDDHPilNdaYRlMOW6244EbnhCjxBFlh5MNHQZhlTq
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: 83541d98-df51-4afb-3f92-08d76188997c
X-MS-Exchange-CrossTenant-originalarrivaltime: 05 Nov 2019 00:39:21.6346
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 8ae927fe-1255-47a7-a2af-5f3a069daaa2
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: Q2ZXB4/R/Ki2O5Tu9LVd2wA6f5G6o7pvrP0PgKCvNorBOiuQl0RL0/ZPlaC6d1QI
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN6PR15MB2494
X-OriginatorOrg: fb.com
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.95,1.0.8
 definitions=2019-11-04_12:2019-11-04,2019-11-04 signatures=0
X-Proofpoint-Spam-Details: rule=fb_default_notspam policy=fb_default score=0 mlxlogscore=999
 spamscore=0 mlxscore=0 malwarescore=0 phishscore=0 suspectscore=0
 impostorscore=0 priorityscore=1501 bulkscore=0 lowpriorityscore=0
 clxscore=1015 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-1908290000 definitions=main-1911050002
X-FB-Internal: deliver
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On 4 Nov 2019, at 19:15, Paul Moore wrote:

> On Fri, Nov 1, 2019 at 9:24 AM Chris Mason <clm@fb.com> wrote:
>> On 31 Oct 2019, at 19:27, Paul Moore wrote:
>>> It's been a while, but I thought we suggested Dave try running
>>> 'auditctl -a never,task' to see if that would solve his problem and=20
>>> I
>>> believe his answer was no, which confused me a bit as the
>>> audit_filter_task() call in audit_alloc() should see that rule and
>>> return a state of AUDIT_DISABLED which not only prevents=20
>>> audit_alloc()
>>> from allocating an audit_context (and remember if the audit_context=20
>>> is
>>> NULL then audit_dummy_context() returns true), but it also clears=20
>>> the
>>> TIF_SYSCALL_AUDIT flag (which I'm guessing you also want).
>>
>> Thanks for the reminder on this part, I meant to test it.  Yes,=20
>> auditctl
>> -a never,task does stop the messages, even without my patch applied.
>
> I'm glad to hear that worked, I was going to be *very* confused if you
> came back and said you were still seeing NTP records.
>
> I would suggest that regardless of what happens with audit_enabled you
> likely want to keep this audit rule as part of your boot
> configuration, not only does it squelch the audit records, but it
> should improve performance as well (at the cost of no syscall
> auditing).  A number of Linux distros have this as their default at
> boot.
>

Definitely, we'll be testing auditctl -a never,task internally.  Before=20
we went down that path I wanted to fully understand what was going on,=20
but I think all the big questions have been answered at this point.

I'm happy to try variations on my patch, but if you want to include it,=20
please do remember that I've really only tested it with auditing off.

-chris