On Fri, 2006-03-31 at 08:28 -0500, Steve Grubb wrote:
> On Friday 31 March 2006 01:11, Dustin Kirkland wrote:
> > Steve, if you could (a) take a close look at this patch and ensure that
> > I'm closely following your model, and (b) build this patch and run
> > similar performance benchmarks, that would be great. I'm traveling
> > tomorrow and will be out of pocket for the next few days.
>
> I needed a patch to do this yesterday and created a patch I was going to send
> out this morning. It is nearly identical to your patch, but I think you
> eliminated a function that I missed. I'll reconcile the differences and post
> a patch in a few minutes.
>
> The only other item left is to find a test case to performance test with.
Here's a very basic one that I've used. It only hits one ipc call, but
it does trigger the audit hooks in msgsnd
# gcc -o test_msgget test_msgget.c
# auditctl -a exit,always -S ipc
# tail /var/log/audit/audit.log
#include <sys/types.h>
#include <sys/ipc.h>
#include <sys/msg.h>
#include <sys/errno.h>
#include <sys/stat.h>
#include <stdio.h>
int main() {
int rc = 0;
int msgid = 0;
int mode;
mode = S_IRWXU;
if( ( msgid = msgget( IPC_PRIVATE, mode ) ) == -1 ) {
printf("ERROR: Unable to allocate new message queue:
errno=%i\n", errno );
goto EXIT;
}
if( ( rc = msgctl( msgid, IPC_RMID, 0 ) ) == -1 ) {
printf( "Error removing message queue with ID = [%d]: errno =
[%i]\n", msgid, errno );
goto EXIT;
}
EXIT:
return rc;
}
--
Linux-audit mailing list
[EMAIL PROTECTED]
https://www.redhat.com/mailman/listinfo/linux-audit
