diff --git a/logd/LogAudit.cpp b/logd/LogAudit.cpp index 51feff396f1cf7283b116fbb4a379502724b0c4f..ee2f32d24ec39ebbbcd7ea54b9a0bb9de1611dc4 100644 --- a/logd/LogAudit.cpp +++ b/logd/LogAudit.cpp @@ -248,7 +248,7 @@ int LogAudit::getLogSocket() { if (fd < 0) { return fd; } - if (audit_set_pid(fd, getpid(), WAIT_YES) < 0) { + if (audit_setup(fd, getpid()) < 0) { audit_close(fd); fd = -1; } diff --git a/logd/libaudit.c b/logd/libaudit.c index ca88d1b224b9177d1e6f7b30707bd945c0e213ad..d00d57959460e827c175465681d4fb80bb6a9ae5 100644 --- a/logd/libaudit.c +++ b/logd/libaudit.c @@ -162,7 +162,7 @@ out: return rc; } -int audit_set_pid(int fd, uint32_t pid, rep_wait_t wmode) +int audit_setup(int fd, uint32_t pid) { int rc; struct audit_message rep; @@ -176,7 +176,8 @@ int audit_set_pid(int fd, uint32_t pid, rep_wait_t wmode) * and the the mask set to AUDIT_STATUS_PID */ status.pid = pid; - status.mask = AUDIT_STATUS_PID; + status.mask = AUDIT_STATUS_PID | AUDIT_STATUS_RATE_LIMIT; + status.rate_limit = 20; // audit entries per second /* Let the kernel know this pid will be registering for audit events */ rc = audit_send(fd, AUDIT_SET, &status, sizeof(status)); @@ -188,24 +189,21 @@ int audit_set_pid(int fd, uint32_t pid, rep_wait_t wmode) /* * In a request where we need to wait for a response, wait for the message * and discard it. This message confirms and sync's us with the kernel. - * This daemon is now registered as the audit logger. Only wait if the - * wmode is != WAIT_NO + * This daemon is now registered as the audit logger. + * + * TODO + * If the daemon dies and restarts the message didn't come back, + * so I went to non-blocking and it seemed to fix the bug. + * Need to investigate further. */ - if (wmode != WAIT_NO) { - /* TODO - * If the daemon dies and restarts the message didn't come back, - * so I went to non-blocking and it seemed to fix the bug. - * Need to investigate further. - */ - audit_get_reply(fd, &rep, GET_REPLY_NONBLOCKING, 0); - } + audit_get_reply(fd, &rep, GET_REPLY_NONBLOCKING, 0); return 0; } int audit_open() { - return socket(PF_NETLINK, SOCK_RAW, NETLINK_AUDIT); + return socket(PF_NETLINK, SOCK_RAW | SOCK_CLOEXEC, NETLINK_AUDIT); } int audit_get_reply(int fd, struct audit_message *rep, reply_t block, int peek) diff --git a/logd/libaudit.h b/logd/libaudit.h index cb114f91d7b290ba05d6fec5319824493d97750f..b9e330d97c97a28a833a79c0d4608e084f902ca1 100644 --- a/logd/libaudit.h +++ b/logd/libaudit.h @@ -37,11 +37,6 @@ typedef enum { GET_REPLY_NONBLOCKING } reply_t; -typedef enum { - WAIT_NO, - WAIT_YES -} rep_wait_t; - /* type == AUDIT_SIGNAL_INFO */ struct audit_sig_info { uid_t uid; @@ -92,12 +87,10 @@ extern int audit_get_reply(int fd, struct audit_message *rep, reply_t block, * The fd returned by a call to audit_open() * @param pid * The pid whom to set as the reciever of audit messages - * @param wmode - * Whether or not to block on the underlying socket io calls. * @return * This function returns 0 on success, -errno on error. */ -extern int audit_set_pid(int fd, uint32_t pid, rep_wait_t wmode); +extern int audit_setup(int fd, uint32_t pid); __END_DECLS