From mboxrd@z Thu Jan  1 00:00:00 1970
From: Valdis.Kletnieks@vt.edu
Subject: Re: option "-n" of auditd
Date: Tue, 29 Apr 2008 02:38:57 -0400
Message-ID: <31764.1209451137@turing-police.cc.vt.edu>
References: <1208430369-23156-1-git-send-email-jmorris@namei.org>
	<20080428163211.GG20637@devserv.devel.redhat.com>
	<001e01c8a9ba$ad02c430$548da70a@truly>
Mime-Version: 1.0
Content-Type: multipart/mixed; boundary="===============2011307411=="
Return-path: <linux-audit-bounces@redhat.com>
Received: from mx3.redhat.com (mx3.redhat.com [172.16.48.32])
	by int-mx1.corp.redhat.com (8.13.1/8.13.1) with ESMTP id m3T6dIxK020296
	for <linux-audit@redhat.com>; Tue, 29 Apr 2008 02:39:18 -0400
Received: from turing-police.cc.vt.edu (turing-police.cc.vt.edu
	[128.173.14.107])
	by mx3.redhat.com (8.13.8/8.13.8) with ESMTP id m3T6d7DH013148
	for <linux-audit@redhat.com>; Tue, 29 Apr 2008 02:39:08 -0400
In-Reply-To: Your message of "Tue, 29 Apr 2008 13:34:20 +0800."
	<001e01c8a9ba$ad02c430$548da70a@truly>
List-Unsubscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: chuli <chul@cn.fujitsu.com>
Cc: linux-audit@redhat.com
List-Id: linux-audit@redhat.com

--===============2011307411==
Content-Type: multipart/signed; boundary="==_Exmh_1209451137_2935P";
	micalg=pgp-sha1; protocol="application/pgp-signature"
Content-Transfer-Encoding: 7bit

--==_Exmh_1209451137_2935P
Content-Type: text/plain; charset=us-ascii

On Tue, 29 Apr 2008 13:34:20 +0800, chuli said:
> Hi, 
> 	I 've tried option "-n" of auditd, but I don't understand what's the meaning of this option?
> 	Is it used for single-user mode of inittab?

It's probably usable for all runlevels, if you're using inittab to (re)start
auditd.  If you don't use it, what will happen is that auditd will do the
traditional double-fork-to-daemonize, init will notice the parent has exited,
and if inittab says 'respawn', will fork/exec another auditd, which will
double-fork, and in a few seconds you've fork-bombed the system into a
smoking crater...

--==_Exmh_1209451137_2935P
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Exmh version 2.5 07/13/2001

iD8DBQFIFsKBcC3lWbTT17ARAnMiAJ4+Jp1AjUK7YNStzYc/n1CedsqW+wCeL58F
aYwNIxhocTN2KERILclesjw=
=Rwk9
-----END PGP SIGNATURE-----

--==_Exmh_1209451137_2935P--


--===============2011307411==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline


--===============2011307411==--