Is audit really disabled?

[Steve Grubb]

On Wednesday 10 August 2005 16:41, James Morris wrote:
> Yes, I think they are login messages.

OK. That bug has a patch. In kernel/audit.c, audit_receive_msg(), sb:

        case AUDIT_USER:
        case AUDIT_FIRST_USER_MSG...AUDIT_LAST_USER_MSG:
                if (!audit_enabled && msg_type != AUDIT_USER_AVC)
                        return 0;


> Why is kauditd still running?

In case any messages need to get written to auditd. Not sure if we want to 
start and stop that thread based on audit_pid being/not being set. I would 
defer that decision to David.

-Steve