On Thu, 2020-06-25 at 15:14 -0400, Paul Moore wrote: > On Wed, Jun 24, 2020 at 1:25 PM Lakshmi Ramasubramanian > <nramas@xxxxxxxxxxxxxxxxxxx> wrote: > > > > On 6/23/20 12:58 PM, Mimi Zohar wrote: > > > > Hi Steve\Paul, > > > > >> Sample audit messages: > > >> > > >> [ 6.303048] audit: type=1804 audit(1592506281.627:2): pid=1 uid=0 > > >> auid=4294967295 ses=4294967295 subj=kernel op=measuring_key > > >> cause=ENOMEM comm="swapper/0" name=".builtin_trusted_keys" res=0 > > >> errno=-12 > > > > > > My only concern is that auditing -ENOMEM will put additional memory > > > pressure on the system. I'm not sure if this is a concern and, if so, > > > how it should be handled. > > > > Do you have any concerns with respect to adding audit messages in low > > memory conditions? > > Assuming the system is not completely toast, the allocation failure > could be a very transient issue; I wouldn't worry too much about it. There was a major clean up of removing ENOMEM error messages through out the kernel a while ago by Wolfram Sang. The subject lines included "don't print error when allocating XXX fails". As it turns out, they were being removed because "kmalloc will print enough information in case of failure." It had nothing to do with memory pressure on the system. Thanks, Paul. I think we're good. Mimi
