• Eric Paris's avatar
    audit: dynamically allocate audit_names when not enough space is in the names array · 5195d8e2
    Eric Paris authored
    This patch does 2 things.  First it reduces the number of audit_names
    allocated in every audit context from 20 to 5.  5 should be enough for all
    'normal' syscalls (rename being the worst).  Some syscalls can still touch
    more the 5 inodes such as mount.  When rpc filesystem is mounted it will
    create inodes and those can exceed 5.  To handle that problem this patch will
    dynamically allocate audit_names if it needs more than 5.  This should
    decrease the typicall memory usage while still supporting all the possible
    kernel operations.
    Signed-off-by: default avatarEric Paris <eparis@redhat.com>
    5195d8e2
auditsc.c 66.8 KB