From 3479c75fb2c364b84f92f92ef8dbab1568134238 Mon Sep 17 00:00:00 2001
From: Cropi <alakatos@redhat.com>
Date: Tue, 4 Aug 2026 14:37:33 +0200
Subject: [PATCH] audit: prevent netlink congestion

Backport upstream fix that calls setsockopt() with NETLINK_NO_ENOBUFS
immediately after audit_open() to prevent netlink socket buffer overflow,
which caused auditd to log 'Error receiving audit netlink packet
(No buffer space available)' messages under high audit event load.

Backport: https://github.com/linux-audit/audit-userspace/commit/abea35d2f7837ab4decb341ae7022eb6598211d8

Resolves: RHEL-102936
Signed-off-by: Cropi <alakatos@redhat.com>
---
 audit.spec                       |  8 ++++-
 prevent-netlink-congestion.patch | 51 ++++++++++++++++++++++++++++++++
 2 files changed, 58 insertions(+), 1 deletion(-)
 create mode 100644 prevent-netlink-congestion.patch

diff --git a/audit.spec b/audit.spec
index 664b595..ca6c55d 100644
--- a/audit.spec
+++ b/audit.spec
@@ -2,7 +2,7 @@
 Summary: User space tools for kernel auditing
 Name: audit
 Version: 3.1.5
-Release: 8%{?dist}
+Release: 9%{?dist}
 License: GPLv2+
 URL: http://people.redhat.com/sgrubb/audit/
 Source0: http://people.redhat.com/sgrubb/audit/%{name}-%{version}.tar.gz
@@ -24,6 +24,7 @@ Patch13: end-of-event.patch
 Patch14: end-of-event-check.patch
 Patch15: end-of-event-gdm.patch
 Patch16: ausearch-checkpoint-race.patch
+Patch17: prevent-netlink-congestion.patch
 
 BuildRequires: make gcc swig
 BuildRequires: openldap-devel
@@ -122,6 +123,7 @@ cp %{SOURCE1} .
 %patch -P 14 -p1
 %patch -P 15 -p1
 %patch -P 16 -p1
+%patch -P 17 -p1
 
 autoreconf -fv --install
 
@@ -310,6 +312,10 @@ fi
 %attr(750,root,root) %{_sbindir}/audispd-zos-remote
 
 %changelog
+* Tue Aug 04 2026 Attila Lakatos <alakatos@redhat.com> - 3.1.5-9
+- Backport: prevent netlink congestion
+  Resolves: RHEL-102936
+
 * Tue Jan 06 2026 Attila Lakatos <alakatos@redhat.com> - 3.1.5-8
 - Fix POSTIN scriplet to not fail during upgrade
   Resolves: RHEL-138696
diff --git a/prevent-netlink-congestion.patch b/prevent-netlink-congestion.patch
new file mode 100644
index 0000000..c2824c4
--- /dev/null
+++ b/prevent-netlink-congestion.patch
@@ -0,0 +1,51 @@
+From abea35d2f7837ab4decb341ae7022eb6598211d8 Mon Sep 17 00:00:00 2001
+From: Steve Grubb <ausearch.1@gmail.com>
+Date: Tue, 9 Jun 2026 14:15:41 -0400
+Subject: [PATCH] prevent netlink congestion
+
+Adapted for audit-3.1.5 (c9s).
+
+Upstream: https://github.com/linux-audit/audit-userspace/commit/abea35d2f7837ab4decb341ae7022eb6598211d8
+---
+ src/auditd.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/src/auditd.c b/src/auditd.c
+--- a/src/auditd.c
++++ b/src/auditd.c
+@@ -34,6 +34,8 @@
+ #include <sys/time.h>
+ #include <sys/stat.h>
+ #include <sys/wait.h>
++#include <sys/socket.h>
++#include <linux/netlink.h>
+ #include <fcntl.h>
+ #include <pthread.h>
+ #include <sys/utsname.h>
+@@ -600,7 +602,7 @@
+ {
+ 	struct sigaction sa;
+ 	struct rlimit limit;
+-	int i, c, rc;
++	int i, c, rc, one = 1;
+ 	static const struct option opts[] = {
+ 		{"foreground", no_argument, NULL, 'f'},
+ 		{"allow_links", no_argument, NULL, 'l'},
+@@ -755,6 +757,17 @@
+ 		free_config(&config);
+ 		return 1;
+ 	}
++	/* Prevent netlink congestion issues */
++	if (setsockopt(fd, SOL_NETLINK, NETLINK_NO_ENOBUFS,
++			&one, sizeof(one)) < 0) {
++		audit_msg(LOG_ERR,
++			"Cannot set netlink no enobufs option (%s)",
++			strerror(errno));
++		audit_close(fd);
++		tell_parent(FAILURE);
++		free_config(&config);
++		return 1;
++	}
+ 
+ 	/* Init the event handler thread */
+ 	write_pid_file();