Re: netlink ACK handling in audit_set_pid()

> I was hoping some other people working on audit would step up. > > One idea I have not tested is to make a "command and control" fd that would > be used for enabling the audit system and setting the pid. This would be > separate from the data fd which processes events. Looks like we lost that ability a couple years ago when missing auditd detection was added. The fd that sets the pid is the one that gets all the events even if there is another fd available that belongs to the same pid.