From mboxrd@z Thu Jan 1 00:00:00 1970 From: Eric Paris Subject: Re: [RFC][PATCH] audit: log join and part events to the read-only multicast log socket Date: Wed, 22 Oct 2014 10:30:12 -0400 Message-ID: <1413988212.30946.71.camel@localhost> References: <30ef5c1ba42b52953e5684a0322975c3f0fadc77.1412706089.git.rgb@redhat.com> <2131923.Byl8GhZuQt@x2> <1645943.LlOpH1gJUB@sifl> <1978142.LNMGsIevqD@x2> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <1978142.LNMGsIevqD@x2> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Steve Grubb Cc: Richard Guy Briggs , linux-audit@redhat.com List-Id: linux-audit@redhat.com On Wed, 2014-10-22 at 10:25 -0400, Steve Grubb wrote: > 12) The struct audit_status was extended to include version and > backlog_wait_time. I cannot determine at runtime if they exist, meaning that > software compiled on a new kernel runs on an old kernel, it will be reading > random stack or heap to make decisions. The correct solution would be to make > a new struct with planned expansion capability with version as the first > element so any changes can be signaled. This new struct would be sent using a > new netlink command. Incorrect. The length of the message makes it perfectly clear how much data the kernel sent, and thus if that data includes the version or backlog_wait_time. I thought this had been discussed before... The answer is 'check how much data you got from the kernel'