On Wed, 17 Dec 2008 05:11:10 +0000 Al Viro <[email protected]> wrote:
> int audit_sockaddr(int len, void *a)
> {
> - struct audit_aux_data_sockaddr *ax;
> struct audit_context *context = current->audit_context;
>
> if (likely(!context || context->dummy))
> return 0;
>
> - ax = kmalloc(sizeof(*ax) + len, GFP_KERNEL);
> - if (!ax)
> - return -ENOMEM;
> -
> - ax->len = len;
> - memcpy(ax->a, a, len);
> + if (!context->sockaddr) {
> + void *p = kmalloc(sizeof(struct sockaddr_storage), GFP_KERNEL);
argh, I really hate having to run all around the code verifying that
the type passed to sizeof matches the type that we'll be storing there :(
> + if (!p)
> + return -ENOMEM;
> + context->sockaddr = p;
> + }
>
> - ax->d.type = AUDIT_SOCKADDR;
> - ax->d.next = context->aux;
> - context->aux = (void *)ax;
> + context->sockaddr_len = len;
> + memcpy(context->sockaddr, a, len);
> return 0;
> }
stoopid question: can an audit_contect be shared between
threads/processes? If so, is locking needed around the read/test/write
of context->sockaddr and friends?
--
Linux-audit mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/linux-audit
