Bug 433339
| Summary: | WARNING: at kernel/auditsc.c:1089 audit_log_exit+0x70a/0xb7c() (Not tainted) | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Daniel Walsh <dwalsh> | ||||||||
| Component: | kernel | Assignee: | Eric Paris <eparis> | ||||||||
| Status: | CLOSED UPSTREAM | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | ||||||||
| Severity: | low | Docs Contact: | |||||||||
| Priority: | low | ||||||||||
| Version: | rawhide | CC: | aviro, davej, eparis, sgrubb, vonbrand | ||||||||
| Target Milestone: | --- | ||||||||||
| Target Release: | --- | ||||||||||
| Hardware: | All | ||||||||||
| OS: | Linux | ||||||||||
| Whiteboard: | |||||||||||
| Fixed In Version: | Doc Type: | Bug Fix | |||||||||
| Doc Text: | Story Points: | --- | |||||||||
| Clone Of: | Environment: | ||||||||||
| Last Closed: | 2008-02-19 15:05:39 UTC | Type: | --- | ||||||||
| Regression: | --- | Mount Type: | --- | ||||||||
| Documentation: | --- | CRM: | |||||||||
| Verified Versions: | Category: | --- | |||||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||||
| Embargoed: | |||||||||||
| Attachments: |
|
||||||||||
|
Description
Daniel Walsh
2008-02-18 19:12:50 UTC
Created attachment 295193 [details]
dmesg
Created attachment 295194 [details]
/var/log/audit/audit.log
Created attachment 295195 [details]
/var/log/messages
looks like I must have screwed something up in execve audit logging.... Looks like a duplicate of bz #433125. i'll comment in 433125, but I don't see how this issue could cause programs to fail. execve logging is failing, but we aren't terminating the process or doing anything other than wasting huge amounts of cpu time/log space. dwalsh told me on irc: auditctl -l LIST_RULES: exit,always watch=/etc/shadow perm=wa key=auth also I'm not seeing this on my latest git pulls from linus, so maybe its something fedora specific? I'm obviously missing something as on my test machine: [root@dhcp231-146 ~]# uname -a Linux dhcp231-146.rdu.redhat.com 2.6.25-0.40.rc1.git2.fc9 #1 SMP Wed Feb 13 17:17:48 EST 2008 x86_64 x86_64 x86_64 GNU/Linux [root@dhcp231-146 ~]# auditctl -l LIST_RULES: exit,always watch=/etc/shadow perm=rw key=auth and I've got no problems. What do you actually have in /etc/audit/audit.rules? Maybe there is some rule that isn't showing up out of -l from the kernel somehow? ok, its finally happening on my rawhide box with both fedora and stock git kernels from a couple hours ago. fully up2date rawhide setenforce 0 /etc/audit/audit.rules contains -w /etc/shadow -p wa -k auth reboot and watch it.... https://www.redhat.com/archives/linux-audit/2008-February/msg00010.html appears to fix it for me. until this heads upstream and back down we probably shouldn't be using audit rules :( audit rule + avc = boom. The patch listed at 10 is now in the upstream kernel. |