From mboxrd@z Thu Jan  1 00:00:00 1970
From: Eric Paris <eparis@redhat.com>
Subject: Re: proposing [PATCH] audit: get rid of *NO* daemon at audit_pid=0
	message
Date: Mon, 11 Nov 2013 12:21:33 -0500
Message-ID: <1384190493.2938.58.camel@localhost>
References: <20131029230500.GC15011@mguzik.redhat.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
In-Reply-To: <20131029230500.GC15011@mguzik.redhat.com>
List-Unsubscribe: <https://www.redhat.com/mailman/options/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: Mateusz Guzik <mguzik@redhat.com>
Cc: rgb@redhat.com, linux-audit@redhat.com
List-Id: linux-audit@redhat.com

On Wed, 2013-10-30 at 00:05 +0100, Mateusz Guzik wrote:
> Hello,
> 
> I wrote a trivial patch for what I believe is a subsystem you maintain.
> 
> I'm sending it privately first to ensure it looks ok at has proper
> recipients (I'm new to linux world, sorry :>).
> 
> 'To' would be: linux-audit@redhat.com
> 
> The rest is:
> 
> From: Mateusz Guzik <mguzik@redhat.com>
> Date: Tue, 29 Oct 2013 23:51:52 +0100
> Subject: [PATCH] audit: get rid of *NO* daemon at audit_pid=0 message
> 
> kauditd_send_skb is called after audit_pid was checked to be non-zero.
> 
> However, it can be set to 0 due to auditd exiting while kauditd_send_skb
> is still executed and this can result in a spurious warning about missing
> auditd.
> 
> Re-check audit_pid before printing the message.
> 
> Signed-off-by: Mateusz Guzik <mguzik@redhat.com>
> Cc: Eric Paris <eparis@redhat.com>
> Cc: linux-kernel@vger.kernel.org

Acked-by: Eric Paris <eparis@redhat.com>

> ---
>  kernel/audit.c | 8 +++++---
>  1 file changed, 5 insertions(+), 3 deletions(-)
> 
> diff --git a/kernel/audit.c b/kernel/audit.c
> index 7b0e23a..a91a965 100644
> --- a/kernel/audit.c
> +++ b/kernel/audit.c
> @@ -388,9 +388,11 @@ static void kauditd_send_skb(struct sk_buff *skb)
>  	err = netlink_unicast(audit_sock, skb, audit_nlk_portid, 0);
>  	if (err < 0) {
>  		BUG_ON(err != -ECONNREFUSED); /* Shouldn't happen */
> -		printk(KERN_ERR "audit: *NO* daemon at audit_pid=%d\n", audit_pid);
> -		audit_log_lost("auditd disappeared\n");
> -		audit_pid = 0;
> +		if (audit_pid) {
> +			printk(KERN_ERR "audit: *NO* daemon at audit_pid=%d\n", audit_pid);
> +			audit_log_lost("auditd disappeared\n");
> +			audit_pid = 0;
> +		}
>  		/* we might get lucky and get this in the next auditd */
>  		audit_hold_skb(skb);
>  	} else
> -- 
> 1.8.3.1
> 
> Is this ok?
> 
> Thanks,