[RFC PATCH 0/5] Cleanup code in and around audit_expand()
Paul Moore <[email protected]> Fri, 24 Jul 2026 15:56:18 -0400
| Newsgroups | org.kernel.vger.audit |
|---|---|
| Message-ID | <[email protected]> |
The recent audit match overflow patches caused me to take a closer look
at audit_expand() and how it is used, which unsurprisingly revealed a
number of things that we could do a bit better. This patchset is the
result of that and aims to cleanup some of the ugliness while also
making the code a bit more robust.
Currently a RFC pending some closer self-review, but the patchset
compiles, boots, and passes the audit-testsuite and selinux-testsuite
cleanly.
--
Paul Moore (5):
audit: only call audit_expand() once in audit_log_vformat()
audit: convert audit_expand() to operate in multiples of
AUDIT_BUFSIZ
audit: move from a size_t buffer length to an int buffer length
audit: add a missing function definition when !CONFIG_AUDIT
audit: drop BUG_ON() from audit_log_XXX()
include/linux/audit.h | 22 +++++-----
kernel/audit.c | 89 +++++++++++++++++++++---------------------
2 files changed, 57 insertions(+), 54 deletions(-)