rpms/audit
7
0
Fork 0
Code Issues Pull Requests Releases Activity

audit: prevent netlink congestion

Browse Source 
Backport upstream fix that calls setsockopt() with NETLINK_NO_ENOBUFS
immediately after audit_open() to prevent netlink socket buffer overflow,
which caused auditd to log 'Error receiving audit netlink packet
(No buffer space available)' messages under high audit event load.

Backport: abea35d2f7

Resolves: RHEL-102936
Signed-off-by: Cropi <alakatos@redhat.com>
This commit is contained in:
Cropi 2026-08-04 14:37:33 +02:00
parent 1e1a70c747
commit 3479c75fb2
2 changed files with 58 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
audit.spec
View File

@ -2,7 +2,7 @@
Summary: User space tools for kernel auditing
Name: audit
Version: 3.1.5
Release: 8%{?dist}
Release: 9%{?dist}
License: GPLv2+
URL: http://people.redhat.com/sgrubb/audit/
Source0: http://people.redhat.com/sgrubb/audit/%{name}-%{version}.tar.gz
@ -24,6 +24,7 @@ Patch13: end-of-event.patch
Patch14: end-of-event-check.patch
Patch15: end-of-event-gdm.patch
Patch16: ausearch-checkpoint-race.patch
Patch17: prevent-netlink-congestion.patch
BuildRequires: make gcc swig
BuildRequires: openldap-devel
@ -122,6 +123,7 @@ cp %{SOURCE1} .
%patch -P 14 -p1
%patch -P 15 -p1
%patch -P 16 -p1
%patch -P 17 -p1
autoreconf -fv --install
@ -310,6 +312,10 @@ fi
%attr(750,root,root) %{_sbindir}/audispd-zos-remote
%changelog
* Tue Aug 04 2026 Attila Lakatos <alakatos@redhat.com> - 3.1.5-9
- Backport: prevent netlink congestion
Resolves: RHEL-102936
* Tue Jan 06 2026 Attila Lakatos <alakatos@redhat.com> - 3.1.5-8
- Fix POSTIN scriplet to not fail during upgrade
Resolves: RHEL-138696

51
prevent-netlink-congestion.patch Normal file
View File

@ -0,0 +1,51 @@
From abea35d2f7837ab4decb341ae7022eb6598211d8 Mon Sep 17 00:00:00 2001
From: Steve Grubb <ausearch.1@gmail.com>
Date: Tue, 9 Jun 2026 14:15:41 -0400
Subject: [PATCH] prevent netlink congestion
Adapted for audit-3.1.5 (c9s).
Upstream: https://github.com/linux-audit/audit-userspace/commit/abea35d2f7837ab4decb341ae7022eb6598211d8
---
src/auditd.c | 13 ++++++++++++-
1 file changed, 12 insertions(+), 1 deletion(-)
diff --git a/src/auditd.c b/src/auditd.c
--- a/src/auditd.c
+++ b/src/auditd.c
@@ -34,6 +34,8 @@
#include <sys/time.h>
#include <sys/stat.h>
#include <sys/wait.h>
+#include <sys/socket.h>
+#include <linux/netlink.h>
#include <fcntl.h>
#include <pthread.h>
#include <sys/utsname.h>
@@ -600,7 +602,7 @@
{
struct sigaction sa;
struct rlimit limit;
- int i, c, rc;
+ int i, c, rc, one = 1;
static const struct option opts[] = {
{"foreground", no_argument, NULL, 'f'},
{"allow_links", no_argument, NULL, 'l'},
@@ -755,6 +757,17 @@
free_config(&config);
return 1;
}
+ /* Prevent netlink congestion issues */
+ if (setsockopt(fd, SOL_NETLINK, NETLINK_NO_ENOBUFS,
+ &one, sizeof(one)) < 0) {
+ audit_msg(LOG_ERR,
+ "Cannot set netlink no enobufs option (%s)",
+ strerror(errno));
+ audit_close(fd);
+ tell_parent(FAILURE);
+ free_config(&config);
+ return 1;
+ }
/* Init the event handler thread */
write_pid_file();