Netlink audit subsystem analysis

Netlink is a network-based communication mechanism that allows communication within the kernel and between the kernel and the user layer. For more information, see rfc3133.

Netlink has the following advantages over procfs or sysfs:

1. No polling is required.

2. simple and easy to implement.

3. the kernel can directly send information to the user layer without prior requests from the user layer.

Netlink only supports datagram information, but provides two-way communication. In addition, Netlink not only supports unicast information, but also supports multicasting. Like other socket mechanisms, Netlink works asynchronously.

Audit Subsystem code: kernle/audit. c

/* Initialize audit support at boot time. */static int __init audit_init(void){    int i;    if (audit_initialized == AUDIT_DISABLED)        return 0;    printk(KERN_INFO "audit: initializing netlink socket (%s)\n",           audit_default ? "enabled" : "disabled");    audit_sock = netlink_kernel_create(&init_net, NETLINK_AUDIT, 0,                       audit_receive, NULL, THIS_MODULE);    if (!audit_sock)        audit_panic("cannot initialize netlink socket");    else        audit_sock->sk_sndtimeo = MAX_SCHEDULE_TIMEOUT;    skb_queue_head_init(&audit_skb_queue);    skb_queue_head_init(&audit_skb_hold_queue);    audit_initialized = AUDIT_INITIALIZED;    audit_enabled = audit_default;    audit_ever_enabled |= !!audit_default;    audit_log(NULL, GFP_KERNEL, AUDIT_KERNEL, "initialized");    for (i = 0; i < AUDIT_INODE_BUCKETS; i++)        INIT_LIST_HEAD(&audit_inode_hash[i]);    return 0;}

Callback Function

/* Receive messages from netlink socket. */static void audit_receive(struct sk_buff  *skb){    mutex_lock(&audit_cmd_mutex);    audit_receive_skb(skb);    mutex_unlock(&audit_cmd_mutex);}

Implementation

/* * Get message from skb.  Each message is processed by audit_receive_msg. * Malformed skbs with wrong length are discarded silently. */static void audit_receive_skb(struct sk_buff *skb){    struct nlmsghdr *nlh;    /*     * len MUST be signed for NLMSG_NEXT to be able to dec it below 0     * if the nlmsg_len was not aligned     */    int len;    int err;    nlh = nlmsg_hdr(skb);    len = skb->len;    while (NLMSG_OK(nlh, len)) {        err = audit_receive_msg(skb, nlh);        /* if err or if this message says it wants a response */        if (err || (nlh->nlmsg_flags & NLM_F_ACK))            netlink_ack(skb, nlh, err);        nlh = NLMSG_NEXT(nlh, len);    }}

Refer:

Http://my.oschina.net/longscu/blog/59534

Http://www.cnitblog.com/SpiWolf/archive/2006/06/14/5514.html