public inbox for linux-audit@redhat.com
 help / color / mirror / Atom feed
From: Linda Knippers <linda.knippers@hp.com>
To: Eric Paris <eparis@redhat.com>
Cc: linux-audit@redhat.com
Subject: Re: audit_pid with multiple userspace auditd processes
Date: Wed, 07 Jan 2009 17:04:35 -0500	[thread overview]
Message-ID: <496526F3.2070609@hp.com> (raw)
In-Reply-To: <1231364199.31089.61.camel@localhost.localdomain>

Eric Paris wrote:
> So I noticed today something strange, but maybe not wrong?
> 
> lets say userspace starts 2 copies of auditd.  

Will a second auditd actually start?  Seems like it shouldn't.

> Then they kill the first
> copy.  The kernel at that point thinks there is no userspace auditd
> running and will instead send things to dmesg
> 
> We could fix it by changing the handling in audit_receive_msg to reject
> setting the audit_pid to 0 if the current audit_nlk_pid !=
> NETLINK_CB(skb).pid.
> 
> It's not a big deal, maybe we just call results of audit with multiple
> userspace auditd's running at the same time a undefined and not care.

I think its something to be avoided.  Can the 2nd auditd exit if
there already is one?

-- ljk
> 
> Anyone think that's worth a patch?
> 
> -Eric
> 
> --
> Linux-audit mailing list
> Linux-audit@redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit

  reply	other threads:[~2009-01-07 22:04 UTC|newest]

Thread overview: 10+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2009-01-07 21:36 audit_pid with multiple userspace auditd processes Eric Paris
2009-01-07 22:04 ` Linda Knippers [this message]
2009-01-07 22:10   ` Eric Paris
2009-01-07 22:12     ` Linda Knippers
2009-01-07 22:41 ` Steve Grubb
2009-01-07 22:54   ` Eric Paris
2009-01-07 23:07     ` Steve Grubb
2009-01-07 23:11       ` Linda Knippers
2009-01-07 23:24         ` Steve Grubb
2009-01-07 23:33           ` Linda Knippers

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=496526F3.2070609@hp.com \
    --to=linda.knippers@hp.com \
    --cc=eparis@redhat.com \
    --cc=linux-audit@redhat.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox