From: "Lucas C. Villa Real" <lucasvr@gobolinux.org>
To: Eric Paris <eparis@redhat.com>
Cc: linux-audit@redhat.com
Subject: Re: Handling -ENOBUFS
Date: Mon, 10 Nov 2008 19:25:34 -0200 [thread overview]
Message-ID: <2c03f9590811101325vede7156kb9a66bcec8a08fa9@mail.gmail.com> (raw)
In-Reply-To: <1225980965.3300.164.camel@localhost.localdomain>
On Thu, Nov 6, 2008 at 12:16 PM, Eric Paris <eparis@redhat.com> wrote:
> On Wed, 2008-11-05 at 18:56 -0200, Lucas C. Villa Real wrote:
>> On Wed, Nov 5, 2008 at 4:19 PM, Steve Grubb <sgrubb@redhat.com> wrote:
>
>> >> One interesting thing which I noticed is that 'auditctl -s' doesn't
>> >> report that messages were lost,
>> >
>> > They weren't lost by the audit system so it doesn't know they didn't arrive.
>>
>> Do you think it would make sense to add an extra member to struct
>> sk_buff (a pointer to a callback function) and then have
>> skb_queue_tail() signal if it failed to send a message? That would
>> allow audit to keep track of such losses, as well as any other
>> subsystem using netlink for communicating with userspace.
>
> Getting a new field in skb is basically a non-starter. Well, unless you
> can find a way to drop 2 fields...
Hi, Eric
Sorry for the late reply.
Indeed, I looked at that structure and it seems like that's not the
best approach.
> Anyway, I just walked the entire kernel audit "send" system and I don't
> see any place we could drop an skb. I didn't walk all of the receive
> side so maybe there is something in that code but it's unlikely and that
> 'should' be noticed by auditd if there were any errors...
What about audit_send_reply_thread()? We don't check for
netlink_unicast()'s return value. Even though that's not the channel
used to send events, the error seen in auditd logs could be coming
from this point, as the scripts we're running here perform a couple of
queries from time to time to audit in kernel space.
> I know auditd has a issue where it can not write things to the log file
> even though they came out of the netlink socket (messages over 4k or
> so). Can you run auditd under strace and see if the number of netlink
> messages it gets is equal to the number you expect or equal to the
> number that show up in the logs? Things aren't supposed to get dropped
> silently....
Last night I realized that my audit_sanitize_log script (which groups
events by their sequence number) had a problem dealing with events
which crossed the boundaries of an audit log after a rotate request
(ie: a few lines for a given event showed up in the rotated log, and a
few others in the new file which replaced that one). That, together
with a few other things that I've been experimenting here, was the
cause of the files missing from my final report.
Still, I'd like to fix both problems so that we certify that no events
are lost, ever. Do you think Audit could be made more reliable
(regarding the message lost indication) by checking all of
netlink_unicast() retvals?
Thanks!
Lucas
prev parent reply other threads:[~2008-11-10 21:25 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2008-11-05 16:30 Handling -ENOBUFS Lucas C. Villa Real
2008-11-05 18:19 ` Steve Grubb
2008-11-05 20:56 ` Lucas C. Villa Real
2008-11-05 22:05 ` Steve Grubb
2008-11-06 14:16 ` Eric Paris
2008-11-10 21:25 ` Lucas C. Villa Real [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2c03f9590811101325vede7156kb9a66bcec8a08fa9@mail.gmail.com \
--to=lucasvr@gobolinux.org \
--cc=eparis@redhat.com \
--cc=linux-audit@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.