1 files changed, 11 insertions, 1 deletions

diff --git a/kernel/audit.c b/kernel/audit.c
index ad77d1e80895..873b965fdc58 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -608,8 +608,18 @@ static int audit_netlink_ok(struct sk_buff *skb, u16 msg_type)
         int err = 0;
 
         /* Only support initial user namespace for now. */
+        /*
+         * We return ECONNREFUSED because it tricks userspace into thinking
+         * that audit was not configured into the kernel.  Lots of users
+         * configure their PAM stack (because that's what the distro does)
+         * to reject login if unable to send messages to audit.  If we return
+         * ECONNREFUSED the PAM stack thinks the kernel does not have audit
+         * configured in and will let login proceed.  If we return EPERM
+         * userspace will reject all logins.  This should be removed when we
+         * support non init namespaces!!
+         */
         if ((current_user_ns() != &init_user_ns))
-                return -EPERM;
+                return -ECONNREFUSED;
 
         switch (msg_type) {
         case AUDIT_LIST: