On Thursday, October 22, 2015 03:51:59 PM Richard Guy Briggs wrote: > On 15/10/22, Steve Grubb wrote: > > On Thursday, October 22, 2015 02:53:16 PM Richard Guy Briggs wrote: > > > Treat systemd the same way as auditd, allowing it to overrun the queue > > > to avoid blocking. > > > > Do you mind explaining this a little more? I'm having a hard time > > understanding how systemd is involved. > > systemd should only have CAP_AUDIT_READ for the multicast socket and > otherwise behaves as a user client, sending AUDIT_USER_* messages. It > starts and stops auditd and we don't want it blocking trying to allocate > a buffer on the standard queue in audit_log_start() while it is tasked > with telling auditd to start or stop.
Is this something we are hearing reports about? Starting and stopping auditd should be rare in normal use, and by rare I mean start it at boot and don't touch it again ... although I suspect you might update/patch it at some point if your system is long running. If this is a common problem we can look at doing something like this, but if it isn't - and I don't think it is - I'd like to avoid special casing init (it's even more specialized since we are basically talking about just systemd, although others could have similar problems). > > -Steve > > > > > Signed-off-by: Richard Guy Briggs <r...@redhat.com> > > > --- > > > > > > kernel/audit.c | 2 +- > > > 1 files changed, 1 insertions(+), 1 deletions(-) > > > > > > diff --git a/kernel/audit.c b/kernel/audit.c > > > index 3917aad..384a1a1 100644 > > > --- a/kernel/audit.c > > > +++ b/kernel/audit.c > > > @@ -1375,7 +1375,7 @@ struct audit_buffer *audit_log_start(struct > > > audit_context *ctx, gfp_t gfp_mask, return NULL; > > > > > > if (gfp_mask & __GFP_WAIT) { > > > > > > - if (audit_pid && audit_pid == current->tgid) > > > + if (current->tgid == 1 || (audit_pid && audit_pid == current- >tgid)) > > > > > > gfp_mask &= ~__GFP_WAIT; > > > > > > else > > > > > > reserve = 0; > > - RGB > > -- > Richard Guy Briggs <rbri...@redhat.com> > Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, > Red Hat Remote, Ottawa, Canada > Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545 > > -- > Linux-audit mailing list > Linux-audit@redhat.com > https://www.redhat.com/mailman/listinfo/linux-audit -- paul moore www.paul-moore.com -- Linux-audit mailing list Linux-audit@redhat.com https://www.redhat.com/mailman/listinfo/linux-audit