Hi,
I have a quick question. Could be showing my ignorance though...
I'm working on plugin interface for auditd now. It is almost done
but I have some problem with netlink.
Actually I moved almost all current auditd into plugin which is
loaded boot time. Then auditd main process creates threads
for receiver, interpreter and consumer. It seems working fine
with my test program but when I tried to read from netlink
to receive audit messages from receiver thread it fails.
The error is:
"Error receiving netlink packet (Resource temporarily unavailable)"
It seems that netlink is only accessible from main process context.
Since getpid() returns main process ID there's no way to let
netlink know it is being called from thread(s) of the process.
I tried thread ID by calling pthread_self(), didn't work either.
To repro same problem with original code(no threads), I moved
audit_get_reply() stuff in auditd.c to thread loop in auditd-event.c.
It was same. Same error.
Could anyone out there enlighten me how to get threads working
with netlink?
Thanks,
-- Junji Kanemaru
Linuon Inc,
Tokyo Japan