Re: [PATCH] audit: allow unlimited backlog queue

[Richard Guy Briggs <rgb@redhat.com>]

On 14/01/15, Steve Grubb wrote:
> On Wednesday, January 15, 2014 12:12:28 PM Richard Guy Briggs wrote:
> > > > Eric and I discussed bumping up the default.  I would have liked to have
> > > > seen somewhere between 320 and 512, but that default would make the
> > > > embedded folks unhappy and I don't really want to get into the more
> > > > complex idea of having it guess what type of system it is trying to
> > > > configure to give a smaller number for embedded systems (which aren't
> > > > all small) and bigger ones to servers (which aren't all big).
> > >
> > > What about making it a compile time choice in the kernel config? I
> > > suggested  making a compile time option, distributions can bump that up
> > > to 512, the default is enough and it can be tuned. Embedded can make the
> > > default whatever they want, too.
> > 
> > Eric and I had discussed that too, and I understand there is
> > considerable pushback to adding to kconfig, so that option would be
> > harder to get accepted.
> 
> So how does making the backlog value of 0 be unlimited solve the problem?

It doesn't directly, but is related.  The patch that allows the kernel
command line to be set with the value does this.  It also helps for
transients.  The documentation in the userspace patch also then becomes
consistent with the kernel command line behaviour.

> -Steve

- RGB

--
Richard Guy Briggs <rbriggs@redhat.com>
Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, Red Hat
Remote, Ottawa, Canada
Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545