On Wed, 2008-11-05 at 18:56 -0200, Lucas C. Villa Real wrote: > On Wed, Nov 5, 2008 at 4:19 PM, Steve Grubb <[EMAIL PROTECTED]> wrote:
> >> One interesting thing which I noticed is that 'auditctl -s' doesn't > >> report that messages were lost, > > > > They weren't lost by the audit system so it doesn't know they didn't arrive. > > Do you think it would make sense to add an extra member to struct > sk_buff (a pointer to a callback function) and then have > skb_queue_tail() signal if it failed to send a message? That would > allow audit to keep track of such losses, as well as any other > subsystem using netlink for communicating with userspace. Getting a new field in skb is basically a non-starter. Well, unless you can find a way to drop 2 fields... Anyway, I just walked the entire kernel audit "send" system and I don't see any place we could drop an skb. I didn't walk all of the receive side so maybe there is something in that code but it's unlikely and that 'should' be noticed by auditd if there were any errors... I know auditd has a issue where it can not write things to the log file even though they came out of the netlink socket (messages over 4k or so). Can you run auditd under strace and see if the number of netlink messages it gets is equal to the number you expect or equal to the number that show up in the logs? Things aren't supposed to get dropped silently.... -Eric -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
