2 files changed, 16 insertions, 1 deletions

diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h
index 843540c398eb..d820aa979620 100644
--- a/include/uapi/linux/audit.h
+++ b/include/uapi/linux/audit.h
@@ -110,6 +110,7 @@
 #define AUDIT_SECCOMP           1326    /* Secure Computing event */
 #define AUDIT_PROCTITLE         1327    /* Proctitle emit event */
 #define AUDIT_FEATURE_CHANGE    1328    /* audit log listing feature changes */
+#define AUDIT_REPLACE           1329    /* Replace auditd if this packet unanswerd */
 
 #define AUDIT_AVC               1400    /* SE Linux avc denial or grant */
 #define AUDIT_SELINUX_ERR       1401    /* Internal SE Linux Errors */
diff --git a/kernel/audit.c b/kernel/audit.c
index d6dd95cc59e6..2fd63d6879c5 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -809,6 +809,16 @@ static int audit_set_feature(struct sk_buff *skb)
         return 0;
 }
 
+static int audit_replace(pid_t pid)
+{
+        struct sk_buff *skb = audit_make_reply(0, 0, AUDIT_REPLACE, 0, 0,
+                                               &pid, sizeof(pid));
+
+        if (!skb)
+                return -ENOMEM;
+        return netlink_unicast(audit_sock, skb, audit_nlk_portid, 0);
+}
+
 static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
 {
         u32                     seq;
@@ -870,9 +880,13 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                 }
                 if (s.mask & AUDIT_STATUS_PID) {
                         int new_pid = s.pid;
+                        pid_t requesting_pid = task_tgid_vnr(current);
 
-                        if ((!new_pid) && (task_tgid_vnr(current) != audit_pid))
+                        if ((!new_pid) && (requesting_pid != audit_pid))
                                 return -EACCES;
+                        if (audit_pid && new_pid &&
+                            audit_replace(requesting_pid) != -ECONNREFUSED)
+                                return -EEXIST;
                         if (audit_enabled != AUDIT_OFF)
                                 audit_log_config_change("audit_pid", new_pid, audit_pid, 1);
                         audit_pid = new_pid;