Re: Can AUDIT_LIST_RULES causes kthreadd-spam?

Paul Moore <[email protected]> Thu, 4 May 2023 14:40:48 -0400

Newsgroups	com.redhat.linux-audit,org.kernel.vger.audit
Message-ID	<CAHC9VhTfxqrWaJrBccDY9LJR+Fggr__zufD-Wd=0VZwN5bBU6g@mail.gmail.com>

On Wed, May 3, 2023 at 10:50 PM Tetsuo Handa
<[email protected]> wrote:
> On 2023/05/04 7:12, Rinat Gadelshin wrote:
> > On 04.05.2023 00:27, Paul Moore wrote:
> >> Can you be more specific about the kernel threads you are seeing, are
> >> you seeing multiple "kauditd" threads?
> >>
> >> % ps -fC kauditd
> >> UID          PID    PPID  C STIME TTY          TIME CMD
> >> root          89       2  0 Apr28 ?        00:00:00 [kauditd]
>
> I don't think so.
>
> kernel audit subsystem uses kthread_run() in order to run short-lived kernel threads.

Thanks Tetsuo, I agree that's far more likely.  Ever since I took over
shepherding the audit code, all of the thread issues have been around
the main audit queue thread so it's a bit reflexive to assume that is
the case :)

-- 
paul-moore.com

--
Linux-audit mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/linux-audit