(Ignore my comment about /dev/audit - I wasn't thinking, yes I call audit_open) Thanks
In fact I was wrong. In both cases the listener loop is in a secondary thread (gotta read my own code more closely). The differntiator is where the audit_open is called relative to the other threads. So a bit more hacking based on your reply shows the real rule :- The pid passed to audit_set_pid must be the pid that called audit_open not the pid that's listening Thanks agin. All working now -----Original Message----- From: Steve Grubb [mailto:[EMAIL PROTECTED] Sent: Friday, April 20, 2007 4:13 PM To: [email protected] Cc: paul moore Subject: Re: listening to /dev/audit in a pthread program On Friday 20 April 2007 18:35:34 paul moore wrote: > I have an test app that quite happily does an audit_set_pid and then > sits there reading /dev/audit. There isn't a /dev/audit in linux.org kernels. > It works fine if its in the lead thread. But when I run the same code > in my real app it runs in a different thread. The important detail is where the audit_open call is made. Netlink want to send it to the same tid. -Steve -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
