Skip to contentSkip to conversation

proposing [PATCH] audit: get rid of *NO* daemon at audit_pid=0 message

DISCUSSION Eric Paris 3 participants 4 messages Nov 11, 2013 1 message not in the archive

lore
Share & tools
lore

A message that is not in the archive (sent off-list or not yet received): [email protected]

Eric Paris

author Acked-by
#1 lore raw
Quoted 21 lines · Mateusz Guzik

Hello,

I wrote a trivial patch for what I believe is a subsystem you maintain.

I'm sending it privately first to ensure it looks ok at has proper recipients (I'm new to linux world, sorry :>).

'To' would be: [email protected]

The rest is:

From: Mateusz Guzik <[email protected]>
Date: Tue, 29 Oct 2013 23:51:52 +0100
Subject: [PATCH] audit: get rid of *NO* daemon at audit_pid=0 message

kauditd_send_skb is called after audit_pid was checked to be non-zero.

However, it can be set to 0 due to auditd exiting while kauditd_send_skb is still executed and this can result in a spurious warning about missing auditd.

Quoted 5 lines

Re-check audit_pid before printing the message.

Signed-off-by Mateusz Guzik <[email protected]>
Cc Eric Paris <[email protected]>
Cc [email protected]
Acked-by Eric Paris <[email protected]>
Quoted 29 lines
---
 kernel/audit.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)
kernel/audit.c +5 -3
index 7b0e23a..a91a965 100644
@@ -388,9 +388,11 @@ static void kauditd_send_skb(struct sk_buff *skb)
 	err = netlink_unicast(audit_sock, skb, audit_nlk_portid, 0);
 	if (err < 0) {
 		BUG_ON(err != -ECONNREFUSED); /* Shouldn't happen */
-		printk(KERN_ERR "audit: *NO* daemon at audit_pid=%d\n", audit_pid);
-		audit_log_lost("auditd disappeared\n");
-		audit_pid = 0;
+		if (audit_pid) {
+			printk(KERN_ERR "audit: *NO* daemon at audit_pid=%d\n", audit_pid);
+			audit_log_lost("auditd disappeared\n");
+			audit_pid = 0;
+		}
 		/* we might get lucky and get this in the next auditd */
 		audit_hold_skb(skb);
 	} else
Signature · 5 lines
1.8.3.1

Is this ok?

Thanks,
#2 lore raw
Quoted 16 lines · Eric Paris
Quoted 15 lines · Mateusz Guzik

Hello,

I wrote a trivial patch for what I believe is a subsystem you maintain.

I'm sending it privately first to ensure it looks ok at has proper recipients (I'm new to linux world, sorry :>).

'To' would be: [email protected]

The rest is:

From: Mateusz Guzik <[email protected]>
Date: Tue, 29 Oct 2013 23:51:52 +0100
Subject: [PATCH] audit: get rid of *NO* daemon at audit_pid=0 message

Quoted 7 lines
Quoted 7 lines

kauditd_send_skb is called after audit_pid was checked to be non-zero.

However, it can be set to 0 due to auditd exiting while kauditd_send_skb is still executed and this can result in a spurious warning about missing auditd.

Re-check audit_pid before printing the message.

I'm ok with this. It can't hurt. I'll queue it.

Quoted 31 lines
Quoted 3 lines
Signed-off-by Mateusz Guzik <[email protected]>
Cc Eric Paris <[email protected]>
Cc [email protected]
Acked-by Eric Paris <[email protected]>
Quoted 25 lines
 kernel/audit.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)
kernel/audit.c +5 -3
index 7b0e23a..a91a965 100644
@@ -388,9 +388,11 @@ static void kauditd_send_skb(struct sk_buff *skb)
 	err = netlink_unicast(audit_sock, skb, audit_nlk_portid, 0);
 	if (err < 0) {
 		BUG_ON(err != -ECONNREFUSED); /* Shouldn't happen */
-		printk(KERN_ERR "audit: *NO* daemon at audit_pid=%d\n", audit_pid);
-		audit_log_lost("auditd disappeared\n");
-		audit_pid = 0;
+		if (audit_pid) {
+			printk(KERN_ERR "audit: *NO* daemon at audit_pid=%d\n", audit_pid);
+			audit_log_lost("auditd disappeared\n");
+			audit_pid = 0;
+		}
 		/* we might get lucky and get this in the next auditd */
 		audit_hold_skb(skb);
 	} else
Signature · 1 line
1.8.3.1
Quoted 3 lines
Quoted 3 lines

Is this ok?

Thanks,

- RGB

--
Richard Guy Briggs <[email protected]>
Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, Red Hat Remote, Ottawa, Canada
Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545

#3 lore raw
In reply to Eric Paris
Quoted 16 lines · Eric Paris
Quoted 15 lines · Mateusz Guzik

Hello,

I wrote a trivial patch for what I believe is a subsystem you maintain.

I'm sending it privately first to ensure it looks ok at has proper recipients (I'm new to linux world, sorry :>).

'To' would be: [email protected]

The rest is:

From: Mateusz Guzik <[email protected]>
Date: Tue, 29 Oct 2013 23:51:52 +0100
Subject: [PATCH] audit: get rid of *NO* daemon at audit_pid=0 message

Quoted 5 lines
Quoted 5 lines

kauditd_send_skb is called after audit_pid was checked to be non-zero.

However, it can be set to 0 due to auditd exiting while kauditd_send_skb is still executed and this can result in a spurious warning about missing auditd.

Is it really spurious? Meaning an admin at a site making heavy use of the audit subsystem would never want to know this? Are the events always put back with no chance of loss?

-Steve

Quoted 19 lines
Quoted 5 lines

Re-check audit_pid before printing the message.

Signed-off-by Mateusz Guzik <[email protected]>
Cc Eric Paris <[email protected]>
Cc [email protected]
Acked-by Eric Paris <[email protected]>
Quoted 11 lines

---

 kernel/audit.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)
kernel/audit.c +0 -0
index 7b0e23a..a91a965 100644
@@ -388,9 +388,11 @@ static void kauditd_send_skb(struct sk_buff *skb)
Quoted 6 lines

kernel/audit.c static void kauditd_send_skb(struct sk_buff *skb) · line 394

Quoted 6 lines
kernel/audit.c +0 -1
 	err = netlink_unicast(audit_sock, skb, audit_nlk_portid, 0);
 	if (err < 0) {
 
 		BUG_ON(err != -ECONNREFUSED); /* Shouldn't happen */
 
-		printk(KERN_ERR "audit: *NO* daemon at audit_pid=%d\n",

audit_pid);

Quoted 4 lines

kernel/audit.c static void kauditd_send_skb(struct sk_buff *skb) · line 395

Quoted 4 lines
kernel/audit.c +2 -2
-		audit_log_lost("auditd disappeared\n");
-		audit_pid = 0;
+		if (audit_pid) {
+			printk(KERN_ERR "audit: *NO* daemon at audit_pid=%d\n",

audit_pid);

Quoted 13 lines

kernel/audit.c

Quoted 8 lines
kernel/audit.c +3 -0
+			audit_log_lost("auditd disappeared\n");
+			audit_pid = 0;
+		}
kernel/audit.c +0 -0
 		/* we might get lucky and get this in the next auditd */
 		audit_hold_skb(skb);
 
 	} else

--
Linux-audit mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/linux-audit

author
#4 lore raw
Quoted 23 lines · Steve Grubb
Quoted 16 lines · Eric Paris
Quoted 15 lines · Mateusz Guzik

Hello,

I wrote a trivial patch for what I believe is a subsystem you maintain.

I'm sending it privately first to ensure it looks ok at has proper recipients (I'm new to linux world, sorry :>).

'To' would be: [email protected]

The rest is:

From: Mateusz Guzik <[email protected]>
Date: Tue, 29 Oct 2013 23:51:52 +0100
Subject: [PATCH] audit: get rid of *NO* daemon at audit_pid=0 message

Quoted 5 lines
Quoted 5 lines

kauditd_send_skb is called after audit_pid was checked to be non-zero.

However, it can be set to 0 due to auditd exiting while kauditd_send_skb is still executed and this can result in a spurious warning about missing auditd.

Quoted 5 lines

Is it really spurious? Meaning an admin at a site making heavy use of the audit subsystem would never want to know this? Are the events always put back with no chance of loss?

-Steve

auidt_pid will only get set to 0 in 2 ways. 1) auditd died, in which case we will record the first lost message (because the pid won't be 0, we set it to 0 after we record that message). 2) auditd/auditctl
explicitly set audit_pid to 0 (aka on shutdown) In which case, we
don't expect such a printk. It is normal that messages which race with auditd shutting down may get 'lost'. If the message came 1 millisecond later it would never have gotten on the queue since audit_pid would be 0.

-Eric

Quoted 47 lines
Quoted 21 lines
Quoted 7 lines

Re-check audit_pid before printing the message.

Signed-off-by Mateusz Guzik <[email protected]>
Cc Eric Paris <[email protected]>
Cc [email protected]
Acked-by Eric Paris <[email protected]>
Quoted 11 lines

---

 kernel/audit.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)
kernel/audit.c +0 -0
index 7b0e23a..a91a965 100644
@@ -388,9 +388,11 @@ static void kauditd_send_skb(struct sk_buff *skb)
Quoted 6 lines

kernel/audit.c static void kauditd_send_skb(struct sk_buff *skb) · line 394

Quoted 6 lines
kernel/audit.c +0 -1
 	err = netlink_unicast(audit_sock, skb, audit_nlk_portid, 0);
 	if (err < 0) {
 
 		BUG_ON(err != -ECONNREFUSED); /* Shouldn't happen */
 
-		printk(KERN_ERR "audit: *NO* daemon at audit_pid=%d\n",

audit_pid);

Quoted 4 lines

kernel/audit.c static void kauditd_send_skb(struct sk_buff *skb) · line 395

Quoted 4 lines
kernel/audit.c +2 -2
-		audit_log_lost("auditd disappeared\n");
-		audit_pid = 0;
+		if (audit_pid) {
+			printk(KERN_ERR "audit: *NO* daemon at audit_pid=%d\n",

audit_pid);

Quoted 13 lines

kernel/audit.c

Quoted 8 lines
kernel/audit.c +3 -0
+			audit_log_lost("auditd disappeared\n");
+			audit_pid = 0;
+		}
kernel/audit.c +0 -0
 		/* we might get lucky and get this in the next auditd */
 		audit_hold_skb(skb);
 
 	} else

--
Linux-audit mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/linux-audit