Re: [PATCH 1/2] audit: stop an old auditd being starved out by a new auditd

2015-09-29 Thread Paul Moore
On Tuesday, September 29, 2015 12:36:11 AM Richard Guy Briggs wrote: > On 15/09/28, Paul Moore wrote: > > On Monday, September 28, 2015 07:17:31 AM Richard Guy Briggs wrote: ... > > > > > So, I believ audit_make_reply() can be used just fine, setting portid, > > > seq, done and multi to zero. >

Re: [PATCH 1/2] audit: stop an old auditd being starved out by a new auditd

2015-09-28 Thread Richard Guy Briggs
On 15/09/28, Paul Moore wrote: > On Monday, September 28, 2015 07:17:31 AM Richard Guy Briggs wrote: > > On 15/09/25, Paul Moore wrote: > > > The audit_make_reply() function is the wrong thing to be using here, we > > > should create our own buffer from scratch like most other records. Also, > > >

Re: [PATCH 1/2] audit: stop an old auditd being starved out by a new auditd

2015-09-28 Thread Paul Moore
On Monday, September 28, 2015 07:17:31 AM Richard Guy Briggs wrote: > On 15/09/25, Paul Moore wrote: ... > > The audit_make_reply() function is the wrong thing to be using here, we > > should create our own buffer from scratch like most other records. Also, > > yes, we want to include the new pi

Re: [PATCH 1/2] audit: stop an old auditd being starved out by a new auditd

2015-09-28 Thread Richard Guy Briggs
On 15/09/25, Paul Moore wrote: > On Friday, September 25, 2015 07:10:19 AM Richard Guy Briggs wrote: > > On 15/09/24, Paul Moore wrote: > > > On Friday, September 18, 2015 03:59:58 AM Richard Guy Briggs wrote: > > > > diff --git a/kernel/audit.c b/kernel/audit.c > > > > index 18cdfe2..3399ab2 10064

Re: [PATCH 1/2] audit: stop an old auditd being starved out by a new auditd

2015-09-25 Thread Paul Moore
On Friday, September 25, 2015 07:10:19 AM Richard Guy Briggs wrote: > On 15/09/24, Paul Moore wrote: > > On Friday, September 18, 2015 03:59:58 AM Richard Guy Briggs wrote: ... > > XXX > > ??? Sorry, ignore that. The "XXX" was a placeholder for me while I was reviewing your patch; normally I

Re: [PATCH 1/2] audit: stop an old auditd being starved out by a new auditd

2015-09-25 Thread Richard Guy Briggs
On 15/09/24, Paul Moore wrote: > On Friday, September 18, 2015 03:59:58 AM Richard Guy Briggs wrote: > > Nothing prevents a new auditd starting up and replacing a valid > > audit_pid when an old auditd is still running, effectively starving out > > the old auditd since audit_pid no longer points to

Re: [PATCH 1/2] audit: stop an old auditd being starved out by a new auditd

2015-09-24 Thread Paul Moore
On Friday, September 18, 2015 03:59:58 AM Richard Guy Briggs wrote: > Nothing prevents a new auditd starting up and replacing a valid > audit_pid when an old auditd is still running, effectively starving out > the old auditd since audit_pid no longer points to the old valid auditd. > > If no messa

[PATCH 1/2] audit: stop an old auditd being starved out by a new auditd

2015-09-18 Thread Richard Guy Briggs
Nothing prevents a new auditd starting up and replacing a valid audit_pid when an old auditd is still running, effectively starving out the old auditd since audit_pid no longer points to the old valid auditd. If no message to auditd has been attempted since auditd died unnaturally or got killed, a