Re: [RFC PATCH 1/3] audit: remove arch_f pointer from struct audit_krule

[Paul Moore]

On Sun, Nov 25, 2018 at 12:11 PM Richard Guy Briggs <rgb@xxxxxxxxxx> wrote:
> On 2018-02-15 15:42, Paul Moore wrote:
> > On Mon, Feb 12, 2018 at 7:29 AM, Richard Guy Briggs <rgb@xxxxxxxxxx> wrote:
> > > The arch_f pointer was added to the struct audit_krule in commit:
> > > e54dc2431d740a79a6bd013babade99d71b1714f ("audit signal recipients")
> > >
> > > This is only used on addition and deletion of rules which isn't time
> > > critical and the arch field is likely to be one of the first fields,
> > > easily found iterating over the field type.  This isn't worth the
> > > additional complexity and storage.  Delete the field.
> > >
> > > Signed-off-by: Richard Guy Briggs <rgb@xxxxxxxxxx>
> > > ---
> > >  include/linux/audit.h |  1 -
> > >  kernel/auditfilter.c  | 12 ++++++++----
> > >  2 files changed, 8 insertions(+), 5 deletions(-)
> >
> > I haven't decided if I like the removal of arch_f or not, but I think
> > I might know where your oops/panic is coming from, thoughts below ...
>
> Have you decided yet if you like the removal of the arch_f pointer or
> not?  An updated v2 was provided the following day:
>         https://www.redhat.com/archives/linux-audit/2018-February/msg00059.html

I still think I'd like to keep it as-is for now.

-- 
paul moore
www.paul-moore.com