listening to /dev/audit in a pthread program
Steve Grubb
sgrubb at redhat.com
Fri Apr 20 23:13:23 UTC 2007
On Friday 20 April 2007 18:35:34 paul moore wrote:
> I have an test app that quite happily does an audit_set_pid and then sits
> there reading /dev/audit.
There isn't a /dev/audit in linux.org kernels.
> It works fine if its in the lead thread. But when I run the same code in my
> real app it runs in a different thread.
The important detail is where the audit_open call is made. Netlink want to
send it to the same tid.
-Steve
More information about the Linux-audit
mailing list