Re: [PATCH] Audit: save audit_backlog_limit audit messages in case auditd comes back
On Thursday 27 March 2008 17:37:44 Eric Paris wrote:
This is useful to collect audit messages during bootup and even when
auditd
is stopped. This is NOT a reliable mechanism, it does not ever call
audit_panic, nor should it.
Thanks Eric for working on this. We've needed this for quite a while so that
we can see some of the avcs that happen during boot.
If auditd never starts the kernel will hold by default up to 64
messages
in memory forever.
I have an idea. Maybe this behavior could be enabled if audit=1 is passed as a
boot parameter. In this way, you would know that the user intended for the
audit daemon to start at some point. You could then call audit panic or
whatever else is normal. If no audit=1 is passed, you could just do the
printk like usual and not waste memory. Would this be helpful?
Thanks,
-Steve