Closed
Description
The corrent deployment or update mode relies on auditd stopping/restarting laurel. This has a few shortcomings:
- If laurel has crashed too often, auditd will not restart it even if the binary has changed.
- The workaround, restarting auditd, means that messages will be lost. (This is probably the main reason whssy RHEL systems forbid auditd to be restarted though systemd mechanisms.)
- Multi-message events may be split into a pre-restart and post-restart portion.
- State (process table including labels) is lost across restart.
To overcome those shortcomings, the following features should be implemented:
- Signal handler
- Dump state to file (on disk or memfd). This file should contain in-flight messages, shadow process table, current configuration.
- Re-exec,
- passing the file descriptor to the new process.
Metadata
Metadata
Assignees
Labels
No labels