audit: move kaudit thread start from auditd registration to kaudit init (#2) (55a6f170) · Commits · 戴 / test

Richard made this change some time ago but Eric backed it out because the rest of the supporting code wasn't ready. In order to move the netlink multicast send to kauditd_thread we need to ensure the kauditd_thread is always running, so restore commit ("audit: move kaudit thread start from auditd registration to kaudit init"). Signed-off-by:

Richard Guy Briggs <rbriggs@redhat.com> [PM: brought forward and merged based on Richard's old patch] Signed-off-by:

Paul Moore <paul@paul-moore.com>

kernel/audit.c

+4 −10

Original line number	Diff line number	Diff line
		@@ -832,16 +832,6 @@ static int audit_receive_msg(struct sk_buff skb, struct nlmsghdr nlh)
		if (err)
		return err;

		/* As soon as there's any sign of userspace auditd,
		* start kauditd to talk to it */
		if (!kauditd_task) {
		kauditd_task = kthread_run(kauditd_thread, NULL, "kauditd");
		if (IS_ERR(kauditd_task)) {
		err = PTR_ERR(kauditd_task);
		kauditd_task = NULL;
		return err;
		}
		}
		seq = nlh->nlmsg_seq;
		data = nlmsg_data(nlh);

		@@ -1190,6 +1180,10 @@ static int __init audit_init(void)
		audit_default ? "enabled" : "disabled");
		register_pernet_subsys(&audit_net_ops);

		kauditd_task = kthread_run(kauditd_thread, NULL, "kauditd");
		if (IS_ERR(kauditd_task))
		return PTR_ERR(kauditd_task);

		skb_queue_head_init(&audit_skb_queue);
		skb_queue_head_init(&audit_skb_hold_queue);
		audit_initialized = AUDIT_INITIALIZED;

Admin message