tree b797d759fb81aa461bf0d7734e2f5be7b5e75288
parent 2532386f480eefbdd67b48be55fb4fb3e5a6081c
author Eric Paris <eparis@redhat.com> 1208527348 -0400
committer Al Viro <viro@zeniv.linux.org.uk> 1209377944 -0400

Audit: save audit_backlog_limit audit messages in case auditd comes back

This patch causes the kernel audit subsystem to store up to
audit_backlog_limit messages for use by auditd if it ever appears
sometime in the future in userspace.  This is useful to collect audit
messages during bootup and even when auditd is stopped.  This is NOT a
reliable mechanism, it does not ever call audit_panic, nor should it.
audit_log_lost()/audit_panic() are called during the normal delivery
mechanism.  The messages are still sent to printk/syslog as usual and if
too many messages appear to be queued they will be silently discarded.

I liked doing it by default, but this patch only uses the queue in
question if it was booted with audit=1 or if the kernel was built
enabling audit by default.

Signed-off-by: Eric Paris <eparis@redhat.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>