On Wed, 2009-01-07 at 17:41 -0500, Steve Grubb wrote: > On Wednesday 07 January 2009 04:36:39 pm Eric Paris wrote: > > lets say userspace starts 2 copies of auditd. > > # auditctl -s > AUDIT_STATUS: enabled=1 flag=1 pid=4488 rate_limit=0 backlog_limit=512 lost=1 > backlog=0 > # /sbin/auditd > # auditctl -s > AUDIT_STATUS: enabled=1 flag=1 pid=0 rate_limit=0 backlog_limit=512 lost=1 > backlog=0 > # ps -ef | grep auditd > root 580 2 0 08:19 ? 00:00:00 [kauditd] > root 4488 1 0 16:35 ? 00:00:00 auditd > root 5128 3654 0 17:33 pts/1 00:00:00 grep auditd > > > > Then they kill the first copy. The kernel at that point thinks there is no > > userspace auditd running and will instead send things to dmesg > > Looks to me like the kernel is setting auditd_pid to 0 and the second auditd > does not start - at least with my current setup. > > For some other setups, it probably overwrites the pid with the new one and > keeps going. > > > > We could fix it by changing the handling in audit_receive_msg to reject > > setting the audit_pid to 0 if the current audit_nlk_pid != > > NETLINK_CB(skb).pid. > > Well, what if the first crashed and the kernel didn't know it yet? It might > be > better to forcibly break the connection to the original auditd.
I'm only talking about allowing userspace to "cleanly" unset it's belief there is an auditd out there if the message comes from that process. We'll still handle death by means of the usual netlink socket failures... If auditd number 2 is the auditd the kernel knows about why should auditd number 1 be allowed to "cleanly" say there is no auditd? > > It's not a big deal, maybe we just call results of audit with multiple > > userspace auditd's running at the same time a undefined and not care. > > What do you get for auditctl -s before and after starting your second auditd? [r...@unused kernel-2]# auditd [r...@unused kernel-2]# auditctl -s AUDIT_STATUS: enabled=1 flag=1 pid=752 rate_limit=0 backlog_limit=320 lost=0 backlog=0 [r...@unused kernel-2]# ps -ef | grep auditd root 752 1 0 17:48 ? 00:00:00 auditd root 962 2 0 14:54 ? 00:00:00 [kauditd] root 1301 2207 0 17:49 pts/0 00:00:00 grep auditd [r...@unused kernel-2]# auditd [r...@unused kernel-2]# auditctl -s AUDIT_STATUS: enabled=1 flag=1 pid=1549 rate_limit=0 backlog_limit=320 lost=0 backlog=0 [r...@unused kernel-2]# ps -ef | grep auditd root 752 1 0 17:48 ? 00:00:00 auditd root 962 2 0 14:54 ? 00:00:00 [kauditd] root 1549 1 0 17:49 ? 00:00:00 auditd root 1836 2207 0 17:49 pts/0 00:00:00 grep auditd -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
