audit: get rid of *NO* daemon at audit_pid=0 message
authorRichard Guy Briggs <rgb@redhat.com>
Tue, 26 Nov 2013 23:49:12 +0000 (18:49 -0500)
committerEric Paris <eparis@redhat.com>
Tue, 14 Jan 2014 03:31:07 +0000 (22:31 -0500)
kauditd_send_skb is called after audit_pid was checked to be non-zero.

However, it can be set to 0 due to auditd exiting while kauditd_send_skb
is still executed and this can result in a spurious warning about missing
auditd.

Re-check audit_pid before printing the message.

Signed-off-by: Mateusz Guzik <mguzik@redhat.com>
Cc: Eric Paris <eparis@redhat.com>
Cc: linux-kernel@vger.kernel.org
Acked-by: Eric Paris <eparis@redhat.com>
Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
Signed-off-by: Eric Paris <eparis@redhat.com>
kernel/audit.c

index 72bc1d0..2dc7573 100644 (file)
@@ -410,10 +410,12 @@ static void kauditd_send_skb(struct sk_buff *skb)
        err = netlink_unicast(audit_sock, skb, audit_nlk_portid, 0);
        if (err < 0) {
                BUG_ON(err != -ECONNREFUSED); /* Shouldn't happen */
-               printk(KERN_ERR "audit: *NO* daemon at audit_pid=%d\n", audit_pid);
-               audit_log_lost("auditd disappeared\n");
-               audit_pid = 0;
-               audit_sock = NULL;
+               if (audit_pid) {
+                       printk(KERN_ERR "audit: *NO* daemon at audit_pid=%d\n", audit_pid);
+                       audit_log_lost("auditd disappeared\n");
+                       audit_pid = 0;
+                       audit_sock = NULL;
+               }
                /* we might get lucky and get this in the next auditd */
                audit_hold_skb(skb);
        } else