From mboxrd@z Thu Jan  1 00:00:00 1970
From: Steve Grubb <sgrubb@redhat.com>
Subject: Re: Problem with audit
Date: Fri, 21 Apr 2006 15:48:52 -0400
Message-ID: <200604211548.52720.sgrubb@redhat.com>
References: <444813FD.9060507@us.ibm.com>
	<200604211101.07115.sgrubb@redhat.com>
	<4448FAA9.4040907@us.ibm.com>
Mime-Version: 1.0
Content-Type: text/plain;
  charset="utf-8"
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
In-Reply-To: <4448FAA9.4040907@us.ibm.com>
Content-Disposition: inline
List-Unsubscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: Loulwa Salem <loulwas@us.ibm.com>
Cc: linux-audit@redhat.com
List-Id: linux-audit@redhat.com

On Friday 21 April 2006 11:30, Loulwa Salem wrote:
> sure .. I'm attaching the strace output.

recvfrom(3, "$\0\0\0\2\0\0\0\1\0\0\0\375\10\0\0\377\377\377\377\20\0"..., 
8476, MSG_PEEK|MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, 
[12]) = 36

This is definitely sending back EPERM. EPERM is only sent back when the sender 
does not have CAP_AUDIT_CONTROL. Root processes should have that. Not sure 
why this is failing the first time and OK the second. That seems to sound 
like an uninitialized variable. Nothing has changed in this part of the code 
in a very long time...unless this is another netlink bug.

-Steve