Re: Handling -ENOBUFS

[Eric Paris <eparis@redhat.com>]

On Wed, 2008-11-05 at 18:56 -0200, Lucas C. Villa Real wrote:
> On Wed, Nov 5, 2008 at 4:19 PM, Steve Grubb <sgrubb@redhat.com> wrote:

> >> One interesting thing which I noticed is that 'auditctl -s' doesn't
> >> report that messages were lost,
> >
> > They weren't lost by the audit system so it doesn't know they didn't arrive.
> 
> Do you think it would make sense to add an extra member to struct
> sk_buff (a pointer to a callback function) and then have
> skb_queue_tail() signal if it failed to send a message? That would
> allow audit to keep track of such losses, as well as any other
> subsystem using netlink for communicating with userspace.

Getting a new field in skb is basically a non-starter.  Well, unless you
can find a way to drop 2 fields...

Anyway, I just walked the entire kernel audit "send" system and I don't
see any place we could drop an skb.  I didn't walk all of the receive
side so maybe there is something in that code but it's unlikely and that
'should' be noticed by auditd if there were any errors...

I know auditd has a issue where it can not write things to the log file
even though they came out of the netlink socket (messages over 4k or
so).  Can you run auditd under strace and see if the number of netlink
messages it gets is equal to the number you expect or equal to the
number that show up in the logs?  Things aren't supposed to get dropped
silently....

-Eric