From mboxrd@z Thu Jan 1 00:00:00 1970 From: "paul moore" Subject: RE: listening to /dev/audit in a pthread program Date: Fri, 20 Apr 2007 16:08:33 -0700 Message-ID: References: <200704201845.27504.paul.moore@hp.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from mx2.redhat.com (mx2.redhat.com [10.255.15.25]) by int-mx2.corp.redhat.com (8.13.1/8.13.1) with ESMTP id l3KN8mRp017913 for ; Fri, 20 Apr 2007 19:08:49 -0400 Received: from bay0-omc1-s16.bay0.hotmail.com (bay0-omc1-s16.bay0.hotmail.com [65.54.246.88]) by mx2.redhat.com (8.13.1/8.13.1) with ESMTP id l3KN8lfn014401 for ; Fri, 20 Apr 2007 19:08:47 -0400 Message-ID: <000501c783a0$d14cdd30$656fa8c0@centrify.com> In-Reply-To: <200704201845.27504.paul.moore@hp.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: 'Paul Moore' Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com Sorry Redhat es4 x86 monoproc Kernel 2.6.9-34.EL Audit 1.0.12-1.EL4 gcc 3.4.5 (redhat's) -----Original Message----- From: Paul Moore [mailto:paul.moore@hp.com] Sent: Friday, April 20, 2007 3:45 PM To: paul moore Cc: linux-audit@redhat.com Subject: Re: listening to /dev/audit in a pthread program On Friday, April 20 2007 6:35:34 pm paul moore wrote: > I have an test app that quite happily does an audit_set_pid and then > sits there reading /dev/audit. > > It works fine if its in the lead thread. But when I run the same code > in my real app it runs in a different thread. No matter what PID I > pass to the audit subsystem it complains that nobody is listening > > I did audit_set_pid(....getpid...) - no (passes the pid of the manager > thread) > I did audit_set_pid(....gettid...) - no (passes the pid of the LWP) > > (I dont really mean I did gettid - I did syscall(_NR_gettid)) > > I can see in the complaint message that I have given it the pid I > intended to. > I can see in gdb that my LWP id is the same as the one I send to the > audit subsystem - ie gettid worked. > > Is this a known issue? A little more information would be helpful, such as distribution (I'm guessing SuSE?), kernel version, audit userspace version, etc. -Paul "The Other One" Moore -- paul moore linux security @ hp