From mboxrd@z Thu Jan 1 00:00:00 1970 From: Richard Guy Briggs Subject: Re: Running multiple audit service clients Date: Thu, 11 Feb 2016 23:39:39 -0500 Message-ID: <20160212043939.GC4517@madcap2.tricolour.ca> References: <20160211023015.GI22138@madcap2.tricolour.ca> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Content-Disposition: inline In-Reply-To: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Max Timchenko Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com On 16/02/11, Max Timchenko wrote: > On Wed, Feb 10, 2016 at 9:30 PM, Richard Guy Briggs wrote: > > > On 16/02/10, Max Timchenko wrote: > > > Has anyone tried that before? What would actually happen if two different > > > audit clients tried to use the same interface to the audit subsystem in > > the > > > kernel? > > > > With recent changes upstream, the second would be denied with -EEXIST. > > > > Before that, the older one would be starved out. And versions even > > older might actually have the newer one orphaned in the very occasional > > race where the older one shuts down after the second one starts. > > > > To quote Highlander, "There Can Be Only One". > > Thanks Richard and Paul for your quick responses. It's great to hear > that support for containers is being worked on. > > I have read the docs on audispd(8) - is it something auditd and the > other client could use to enable multiple access? It sounds like > audispd does support multiple clients, but I would guess all clients > would have to use the audispd plugin interface instead of the usual > kernel API. > > What is missing from the documentation for me is the relationship > between audispd and auditd - whether audispd is an optional component > of auditd that can run concurrently, or audispd is a replacement of > auditd when configured (and then auditd cannot run on the same machine > without running into the same multi-client issues). I will defer to Steve Grubb on this quesition as the userspace tools are his domain of expertise. > Yours, > -- > Max - RGB -- Richard Guy Briggs Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, Red Hat Remote, Ottawa, Canada Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545