On Friday, April 20 2007 6:35:34 pm paul moore wrote: > I have an test app that quite happily does an audit_set_pid and then sits > there reading /dev/audit. > > It works fine if its in the lead thread. But when I run the same code in my > real app it runs in a different thread. No matter what PID I pass to the > audit subsystem it complains that nobody is listening > > I did audit_set_pid(....getpid...) - no (passes the pid of the manager > thread) > I did audit_set_pid(....gettid...) - no (passes the pid of the LWP) > > (I dont really mean I did gettid - I did syscall(_NR_gettid)) > > I can see in the complaint message that I have given it the pid I intended > to. > I can see in gdb that my LWP id is the same as the one I send to the audit > subsystem - ie gettid worked. > > Is this a known issue?
A little more information would be helpful, such as distribution (I'm guessing SuSE?), kernel version, audit userspace version, etc. -Paul "The Other One" Moore -- paul moore linux security @ hp -- Linux-audit mailing list Linux-audit@redhat.com https://www.redhat.com/mailman/listinfo/linux-audit