lkml.org 
[lkml]   [2012]   [Sep]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: 3.6-rc4 audit_log_d_path oops.
On Thu, Sep 06, 2012 at 09:32:49AM -0700, Kees Cook wrote:
> > I just realised, the funny thing about this is that the machine running that test
> > had selinux/audit disabled. And yet here we are, screwing around with audit buffers.
>
> The intent was to have this message show up in dmesg even if auditd
> wasn't running, and even if the specific process wasn't being
> explicitly audited.
>
> > Should there be a test on audit_enable=0 in audit_log_link_denied() ?
> >
> > I'm now curious how much more of the audit code is getting run through similar lack of tests
>
> What is the condition in which audit_log_start fails?

in the case of that oops, given I had booted with audit=0, I suspect it was hitting the first check...

1157 if (audit_initialized != AUDIT_INITIALIZED)
1158 return NULL;

Dave



\
 
 \ /
  Last update: 2012-09-07 05:41    [W:0.683 / U:0.044 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site