audit: add audit_backlog_wait_time configuration option

reaahead-collector abuses the audit logging facility to discover which files
are accessed at boot time to make a pre-load list

Add a tuning option to audit_backlog_wait_time so that if auditd can't keep up,
or gets blocked, the callers won't be blocked.

Bump audit_status API version to "2".

Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
Signed-off-by: Eric Paris <eparis@redhat.com>

1 files changed, 2 insertions, 0 deletions

diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h
index 4fdedd4c88a1..14afb0d22902 100644
--- a/include/uapi/linux/audit.h
+++ b/include/uapi/linux/audit.h
@@ -319,6 +319,7 @@ enum {
 #define AUDIT_STATUS_PID                0x0004
 #define AUDIT_STATUS_RATE_LIMIT         0x0008
 #define AUDIT_STATUS_BACKLOG_LIMIT      0x0010
+#define AUDIT_STATUS_BACKLOG_WAIT_TIME  0x0020
                                 /* Failure-to-log actions */
 #define AUDIT_FAIL_SILENT       0
 #define AUDIT_FAIL_PRINTK       1
@@ -377,6 +378,7 @@ struct audit_status {
         __u32           lost;           /* messages lost */
         __u32           backlog;        /* messages waiting in queue */
         __u32           version;        /* audit api version number */
+        __u32           backlog_wait_time;/* message queue wait timeout */
 };
 
 struct audit_features {