Re: Handling -ENOBUFS
On Wed, 2008-11-05 at 18:56 -0200, Lucas C. Villa Real wrote:
On Wed, Nov 5, 2008 at 4:19 PM, Steve Grubb <sgrubb(a)redhat.com>
wrote:
>> One interesting thing which I noticed is that 'auditctl
-s' doesn't
>> report that messages were lost,
>
> They weren't lost by the audit system so it doesn't know they didn't
arrive.
Do you think it would make sense to add an extra member to struct
sk_buff (a pointer to a callback function) and then have
skb_queue_tail() signal if it failed to send a message? That would
allow audit to keep track of such losses, as well as any other
subsystem using netlink for communicating with userspace.
Getting a new field in skb is basically a non-starter. Well, unless you
can find a way to drop 2 fields...
Anyway, I just walked the entire kernel audit "send" system and I don't
see any place we could drop an skb. I didn't walk all of the receive
side so maybe there is something in that code but it's unlikely and that
'should' be noticed by auditd if there were any errors...
I know auditd has a issue where it can not write things to the log file
even though they came out of the netlink socket (messages over 4k or
so). Can you run auditd under strace and see if the number of netlink
messages it gets is equal to the number you expect or equal to the
number that show up in the logs? Things aren't supposed to get dropped
silently....
-Eric