Re: [PATCH] audit: listen in all network namespaces

On Fri, 2013-12-20 at 10:46 +0800, Gao feng wrote: Namespace == mind blown. Ok, so: auditd in audit_ns2 and net_ns2. <--- ONLY process in net_ns2 some process in audit_ns2 and net_ns3 Lets assume that auditd is killed improperly/dies. Because the last process in net_ns2 is gone net_ns2 is invalid/freed. Today in the kernel the way we detect auditd is gone is by using the socket and getting ECONNREFUSSED. So here you think that audit_ns2 should hold a reference on net_ns2, to make sure that socket is always valid. I instead propose that we could run all audit_ns and reset the audit_pid in that namespace and the audit_sock in the namespace to 0/null inside audit_net_exit. Since obviously if the net_ns disappeared, the auditd which was running in any audit namespace in that net_ns isn't running any more. We didn't need to hold a reference on the net_ns. We just have to clear the skb_queue, reset the audit_pid to 0, and reset the socket to NULL... Maybe the one magic socket is the right answer. I'm not arguing against your solution. I'm really trying to understand why we are going that way... This I haven't even started to try to wrap my head around...