[PATCH] Audit: save audit_backlog_limit audit messages in case auditd comes back
LC Bruzenak
lenny at magitekltd.com
Fri Mar 28 15:50:16 UTC 2008
On Thu, 2008-03-27 at 20:52 -0400, Eric Paris wrote:
> On Thu, 2008-03-27 at 17:50 -0400, Steve Grubb wrote:
> > On Thursday 27 March 2008 17:37:44 Eric Paris wrote:
> > > This is useful to collect audit messages during bootup and even when auditd
> > > is stopped. This is NOT a reliable mechanism, it does not ever call
> > > audit_panic, nor should it.
> >
> > Thanks Eric for working on this. We've needed this for quite a while so that
> > we can see some of the avcs that happen during boot.
> >
> >
> > > If auditd never starts the kernel will hold by default up to 64 messages
> > > in memory forever.
> >
> > I have an idea. Maybe this behavior could be enabled if audit=1 is passed as a
> > boot parameter. In this way, you would know that the user intended for the
> > audit daemon to start at some point. You could then call audit panic or
> > whatever else is normal. If no audit=1 is passed, you could just do the
> > printk like usual and not waste memory. Would this be helpful?
>
> I could probably do that. I also could conditionalize it on auditd ever
> having run. I can't imagine it is normal for auditd to be running and
> then stopped forever....
Unless it is an IDS-like event. Or a sysadmin makes a mistake.
>
> Anyone else see value in that situation? Only do it on boot if audit=1
> is passed? Does anyone actually use that command line option?
I will start using it. Audit collected as early in the boot sequence as
possible is better.
>
> -Eric
>
> --
> Linux-audit mailing list
> Linux-audit at redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit
--
LC (Lenny) Bruzenak
lenny at magitekltd.com
More information about the Linux-audit
mailing list