From mboxrd@z Thu Jan  1 00:00:00 1970
From: Steve Grubb <sgrubb@redhat.com>
Subject: Re: check_second_connection stopping my recovery?
Date: Tue, 1 Dec 2009 13:10:24 -0500
Message-ID: <200912011310.24176.sgrubb@redhat.com>
References: <cecd18b00911181501mae505efr931c29c8f840e63a@mail.gmail.com>
Mime-Version: 1.0
Content-Type: Text/Plain;
  charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
In-Reply-To: <cecd18b00911181501mae505efr931c29c8f840e63a@mail.gmail.com>
List-Unsubscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: linux-audit@redhat.com
List-Id: linux-audit@redhat.com

On Wednesday 18 November 2009 06:01:10 pm LC Bruzenak wrote:
> It appears to me as though the new connection code in auditd-listen.c
> is stopping my recovery actions.

<snip>

> So it appears to me that this is now prohibited.  Was this intentional?

Yes, it was. With the reconnect code its possible to DoS a server, so the 
connections need to be limited. I think the best solution is to make an admin 
tweakable setting that defaults to 1 and you can set it to 2. Your recovery 
technique won't be needed in the long term since its planned to have a store-
and-forward model so nothing is lost and its automatically recovered on start 
up.

-Steve