Bug 433339 - WARNING: at kernel/auditsc.c:1089 audit_log_exit+0x70a/0xb7c() (Not tainted)
WARNING: at kernel/auditsc.c:1089 audit_log_exit+0x70a/0xb7c() (Not tainted)
Product: Fedora
Classification: Fedora
Component: kernel (Show other bugs)
All Linux
low Severity low
: ---
: ---
Assigned To: Eric Paris
Fedora Extras Quality Assurance
Depends On:
  Show dependency treegraph
Reported: 2008-02-18 14:12 EST by Daniel Walsh
Modified: 2008-02-25 07:27 EST (History)
5 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2008-02-19 10:05:39 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
dmesg (123.41 KB, application/octet-stream)
2008-02-18 14:12 EST, Daniel Walsh
no flags Details
/var/log/audit/audit.log (44.30 KB, application/x-gzip)
2008-02-18 14:13 EST, Daniel Walsh
no flags Details
/var/log/messages (415.06 KB, application/x-gzip)
2008-02-18 14:13 EST, Daniel Walsh
no flags Details

  None (edit)
Description Daniel Walsh 2008-02-18 14:12:50 EST
Description of problem:


When I boot rawhide with this kernel, the machine quickly goes to 100 CPU.

Lots of oopses
Comment 1 Daniel Walsh 2008-02-18 14:12:50 EST
Created attachment 295193 [details]
Comment 2 Daniel Walsh 2008-02-18 14:13:37 EST
Created attachment 295194 [details]
Comment 3 Daniel Walsh 2008-02-18 14:13:57 EST
Created attachment 295195 [details]
Comment 4 Eric Paris 2008-02-18 14:21:31 EST
looks like I must have screwed something up in execve audit logging....
Comment 5 Jeff Moyer 2008-02-18 14:39:36 EST
Looks like a duplicate of bz #433125.
Comment 6 Eric Paris 2008-02-18 14:50:05 EST
i'll comment in 433125, but I don't see how this issue could cause programs to
fail.  execve logging is failing, but we aren't terminating the process or doing
anything other than wasting huge amounts of cpu time/log space.
Comment 7 Eric Paris 2008-02-18 15:27:21 EST
dwalsh told me on irc:

auditctl -l
LIST_RULES: exit,always watch=/etc/shadow perm=wa key=auth

also I'm not seeing this on my latest git pulls from linus, so maybe its
something  fedora specific?
Comment 8 Eric Paris 2008-02-18 15:49:15 EST
I'm obviously missing something as on my test machine:

[root@dhcp231-146 ~]# uname -a
Linux dhcp231-146.rdu.redhat.com 2.6.25-0.40.rc1.git2.fc9 #1 SMP Wed Feb 13
17:17:48 EST 2008 x86_64 x86_64 x86_64 GNU/Linux
[root@dhcp231-146 ~]# auditctl -l
LIST_RULES: exit,always watch=/etc/shadow perm=rw key=auth

and I've got no problems.  What do you actually have in /etc/audit/audit.rules?
 Maybe there is some rule that isn't showing up out of -l from the kernel somehow?
Comment 9 Eric Paris 2008-02-18 17:05:39 EST
ok, its finally happening on my rawhide box with both fedora and stock git
kernels from a couple hours ago.

fully up2date rawhide
setenforce 0
/etc/audit/audit.rules contains
-w /etc/shadow -p wa -k auth

reboot and watch it....
Comment 10 Eric Paris 2008-02-18 18:26:40 EST

appears to fix it for me.  until this heads upstream and back down we probably
shouldn't be using audit rules   :(

audit rule + avc = boom.
Comment 11 Horst H. von Brand 2008-02-25 07:27:57 EST
The patch listed at 10 is now in the upstream kernel.

Note You need to log in before you can comment on or make changes to this bug.