Re: Increasing audit netlink buffer size

From: Steve Grubb <sgrubb@redhat.com>
To: linux-audit@redhat.com
Subject: Re: Increasing audit netlink buffer size
Date: Tue, 19 Sep 2023 18:40:08 -0400	[thread overview]
Message-ID: <1887121.tdWV9SEqCh@x2> (raw)
In-Reply-To: <CADrBPndcnp8F5ctMZjg_JBs2xzpMgVJhx8VgjSbb77Z-Uuy-aA@mail.gmail.com>

Hello,

Thanks for reporting the issue.

On Friday, September 15, 2023 1:33:42 AM EDT Seyeong Kim wrote:
> Recently I've seen some people who faced below error msg while booting
> or while the machine is working.
> 
> Error receiving audit netlink packet (No buffer space available)
> Error setting audit daemon pid (No buffer space available)
> Unable to set audit pid, exiting
> 
> increasing q_depth=75000 and -b 8192 didn't help for them.
> 
> There is no stable reproducer but I suspect this is because the
> default netlink buffer is not big enough.

The default netlink buffer is set by this sysctl:

# sysctl net.core.rmem_default
net.core.rmem_default = 212992

200k should be plenty to hold a 9k netlink packet at the most.

> Below were my test steps to
> see the above msg.
> 
> 1. launch instance
> 2. enable audit with kernel parameters
> 3. run for i in {1..100000}; do auditctl --reset-lost; done
> 4. while running #3, keep restarting systemctl restart auditd

Hmm. restarting auditd via systemctl can be problematic. It has to wait for 
auditd to terminate or you can have 2 active at once. This is one of the 
reasons why we disallow the direct use of systemctl to 

> I wasn't able to let them test this test pkg but could you please give
> me any advice related to this if it makes sense or not?

This is the only report of this I've heard of. Which kernel? Has the sysctl 
been modified from the default? What are the audit parameters given at the 
boot prompt? Which version of the audit package?

I don't think the code in this area has changed for a long time. Also, 
recvfrom man page does not mention ENOBUFS. The netlink(7) man page seems to 
indicate something about acks possibly causing this. However, loading rules 
is done one at at time. I don't really understand how it gets backed up like 
this unless 2 auditd are stepping on each other somehow.

-Steve

> Thanks in advance. Regards
> 
> Index: audit-3.0.7/lib/netlink.c
> ===================================================================
> --- audit-3.0.7.orig/lib/netlink.c
> +++ audit-3.0.7/lib/netlink.c
> @@ -34,6 +34,9 @@
>  #ifndef NETLINK_AUDIT
>  #define NETLINK_AUDIT 9
>  #endif
> +#ifndef SO_RCVBUFFORCE
> +#define SO_RCVBUFFORCE 33
> +#endif
> 
>  static int adjust_reply(struct audit_reply *rep, int len);
>  static int check_ack(int fd);
> @@ -47,6 +50,7 @@ static int check_ack(int fd);
>  int audit_open(void)
>  {
>         int saved_errno;
> +       int rcvbuf;
>         int fd = socket(PF_NETLINK, SOCK_RAW, NETLINK_AUDIT);
> 
>         if (fd < 0) {
> @@ -62,6 +66,19 @@ int audit_open(void)
>                 errno = saved_errno;
>                 return fd;
>         }
> +
> +       rcvbuf = 10*1024*1024;  // size is temp value for now.
> +       if (setsockopt(fd, SOL_SOCKET, SO_RCVBUFFORCE,
> +                      &rcvbuf, sizeof(rcvbuf))) {
> +               saved_errno = errno;
> +               audit_msg(LOG_ERR,
> +                       "Error setting netlink sock buffer size (%s)",
> +                       strerror(errno));
> +               close(fd);
> +               errno = saved_errno;
> +               return -1;
> +       }
> +
>         if (fcntl(fd, F_SETFD, FD_CLOEXEC) == -1) {
>                 saved_errno = errno;
>                 audit_msg(LOG_ERR,
> 
> --
> Linux-audit mailing list
> Linux-audit@redhat.com
> https://listman.redhat.com/mailman/listinfo/linux-audit

--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit