audit_pid with multiple userspace auditd processes

[Eric Paris]

On Wed, 2009-01-07 at 17:04 -0500, Linda Knippers wrote:
> Eric Paris wrote:
> > So I noticed today something strange, but maybe not wrong?
> > 
> > lets say userspace starts 2 copies of auditd.  
> 
> Will a second auditd actually start?  Seems like it shouldn't.

depends how you start it.  if you use init scripts, no it won't start
another one.  If you just start auditd, nothing stops you.....

> 
> > Then they kill the first
> > copy.  The kernel at that point thinks there is no userspace auditd
> > running and will instead send things to dmesg
> > 
> > We could fix it by changing the handling in audit_receive_msg to reject
> > setting the audit_pid to 0 if the current audit_nlk_pid !=
> > NETLINK_CB(skb).pid.
> > 
> > It's not a big deal, maybe we just call results of audit with multiple
> > userspace auditd's running at the same time a undefined and not care.
> 
> I think its something to be avoided.  Can the 2nd auditd exit if
> there already is one?

the kernel keeps track of the last audit set status message it gets.  it
doesn't care who sent it.  even with my "fix" it isn't great since
starting 2 and killing the second one leaves you a userspace auditd but
kernel still thinks there is nothing out there.....

maybe i'll ponder it, but for now i'm not going to do anything about
it...