audit: give up sending auditing messages when it failed due to EPERM

1 files changed, 13 insertions, 2 deletions

diff --git a/src/manager.c b/src/manager.c
index 1ab4c94ee..cee434466 100644
--- a/src/manager.c
+++ b/src/manager.c
@@ -2448,8 +2448,19 @@ void manager_send_unit_audit(Manager *m, Unit *u, int type, bool success) {
                 return;
         }
 
-        if (audit_log_user_comm_message(m->audit_fd, type, "", p, NULL, NULL, NULL, success) < 0)
-                log_error("Failed to send audit message: %m");
+        if (audit_log_user_comm_message(m->audit_fd, type, "", p, NULL, NULL, NULL, success) < 0) {
+                log_warning("Failed to send audit message: %m");
+
+                if (errno == EPERM) {
+                        /* We aren't allowed to send audit messages?
+                         * Then let's not retry again, to avoid
+                         * spamming the user with the same and same
+                         * messages over and over. */
+
+                        audit_close(m->audit_fd);
+                        m->audit_fd = -1;
+                }
+        }
 
         free(p);
 #endif