Re: [PATCH 2/2] audit: log failed attempts to change audit_pid configuration

2015-09-24 Thread Paul Moore
On Friday, September 18, 2015 03:59:59 AM Richard Guy Briggs wrote: > Failed attempts to change the audit_pid configuration are not presently > logged. One case is an attempt to starve an old auditd by starting up a > new auditd when the old one is still alive and active. The other case > is an a

[PATCH 2/2] audit: log failed attempts to change audit_pid configuration

2015-09-18 Thread Richard Guy Briggs
Failed attempts to change the audit_pid configuration are not presently logged. One case is an attempt to starve an old auditd by starting up a new auditd when the old one is still alive and active. The other case is an attempt to orphan a new auditd when an old auditd shuts down. Log both as AU