Red Hat Bugzilla – Bug 433339
WARNING: at kernel/auditsc.c:1089 audit_log_exit+0x70a/0xb7c() (Not tainted)
Last modified: 2008-02-25 07:27:57 EST
Description of problem:
When I boot rawhide with this kernel, the machine quickly goes to 100 CPU.
Lots of oopses
Created attachment 295193 [details]
Created attachment 295194 [details]
Created attachment 295195 [details]
looks like I must have screwed something up in execve audit logging....
Looks like a duplicate of bz #433125.
i'll comment in 433125, but I don't see how this issue could cause programs to
fail. execve logging is failing, but we aren't terminating the process or doing
anything other than wasting huge amounts of cpu time/log space.
dwalsh told me on irc:
LIST_RULES: exit,always watch=/etc/shadow perm=wa key=auth
also I'm not seeing this on my latest git pulls from linus, so maybe its
something fedora specific?
I'm obviously missing something as on my test machine:
[root@dhcp231-146 ~]# uname -a
Linux dhcp231-146.rdu.redhat.com 2.6.25-0.40.rc1.git2.fc9 #1 SMP Wed Feb 13
17:17:48 EST 2008 x86_64 x86_64 x86_64 GNU/Linux
[root@dhcp231-146 ~]# auditctl -l
LIST_RULES: exit,always watch=/etc/shadow perm=rw key=auth
and I've got no problems. What do you actually have in /etc/audit/audit.rules?
Maybe there is some rule that isn't showing up out of -l from the kernel somehow?
ok, its finally happening on my rawhide box with both fedora and stock git
kernels from a couple hours ago.
fully up2date rawhide
-w /etc/shadow -p wa -k auth
reboot and watch it....
appears to fix it for me. until this heads upstream and back down we probably
shouldn't be using audit rules :(
audit rule + avc = boom.
The patch listed at 10 is now in the upstream kernel.