search for: audit_log_user_messag

Displaying 2 results from an estimated 2 matches for "audit_log_user_messag".

Did you mean: audit_log_user_message
2019 Oct 17
2
Transient permission denied errors when sending audit logs
Hi, In kubevirt we are running into a strange permission problem on libvirt-5.0. We see transient "Permission Denied" errors when "virAuditSend" wants to send an audit log. [1] shows the logs of one of these containers. Here an example: {"component":"virt-launcher","level":"warning","msg":"Failed to send audit message
2019 Oct 17
0
Re: Transient permission denied errors when sending audit logs
...randomly affects one out of a few hundred containers which we start > * It is not bound to a specific node > * It is only transient on that container. After a few denials libvirt can > just continue. The transient nature makes this really bizarre. The error message above comes from the audit_log_user_message() call that libvirt makes. This is implemented in libaudit.so using the sendto() syscall on a netlink socket opened with socket(PF_NETLINK, SOCK_RAW, NETLINK_AUDIT); So in terms of code being run there, there's very little - the EPERM is coming back from the kernel when sending the message...