Messages in this thread | | | Date | Fri, 14 Mar 2008 19:29:27 +0100 | From | Thomas Graf <> | Subject | Re: Audit vs netlink interaction problem |
| |
* Pavel Emelyanov <xemul@openvz.org> 2008-03-14 20:05 > Hmmm... I'm afraid, that this can break the audit filtering and signal > auditing. I haven't yet looked deep into it, but it compares the > task->tgid with this audit_pid for different purposes. If audit_pid > changes this code will be broken.
OK, then both pids have to be stored. audit_pid remains as-is but is no longer used as destination netlink pid. A second pid is stored and updated whenever a netlink message is received from userspace.
> Bu we have no the netlink socket at the moment of setting the pid to > check this. The audit_reveive_msg() call which does this set is received > via another (pre-created global) socket.
I don't understand this. As far as I can read the code, a plain kernel side netlink socket is created in audit_init(). But it doesn't matter, as soon as we receive the first message from userspace, we know the netlink source pid.
> I though, that proper behavior would be to split audit_pid, used for > filtering from the audit_nlk_pid used for netlink communications.
Yes, exactly.
| |