Question: netlink_unicast and thread

Timothy R. Chavez chavezt at gmail.com
Wed Jan 26 14:59:15 UTC 2005


Junji,

The error message your getting looks familiar to me.  Are you sure
that the audit subsystem is enabled within the kernel you're testing
on and that you're booting with option "audit=0"?

-Tim


On Wed, 26 Jan 2005 23:16:26 +0900, Linux <linux at linuon.com> wrote:
> Hi,
> 
> I have a quick question. Could be showing my ignorance though...
> I'm working on plugin interface for auditd now. It is almost done
> but I have some problem with netlink.
> Actually I moved almost all current auditd into plugin which is
> loaded boot time. Then auditd main process creates threads
> for receiver, interpreter and consumer. It seems working fine
> with my test program but when I tried to read from netlink
> to receive audit messages from receiver thread it fails.
> The error is:
> "Error receiving netlink packet (Resource temporarily unavailable)"
> It seems that netlink is only accessible from main process context.
> Since getpid() returns main process ID there's no way to let
> netlink know it is being called from thread(s) of the process.
> I tried thread ID by calling pthread_self(), didn't work either.
> To repro same problem with original code(no threads), I moved
> audit_get_reply() stuff in auditd.c to thread loop in auditd-event.c.
> It was same. Same error.
> 
> Could anyone out there enlighten me how to get threads working
> with netlink?
> 
> Thanks,
> 
> -- Junji Kanemaru
> Linuon Inc,
> Tokyo Japan
> 
> --
> Linux-audit mailing list
> Linux-audit at redhat.com
> http://www.redhat.com/mailman/listinfo/linux-audit
> 


-- 
- Timothy R. Chavez




More information about the Linux-audit mailing list