Description of problem: kernel-2.6.25-0.40.rc1.git2.fc9.x86_64 When I boot rawhide with this kernel, the machine quickly goes to 100 CPU. Lots of oopses
Created attachment 295193 [details] dmesg
Created attachment 295194 [details] /var/log/audit/audit.log
Created attachment 295195 [details] /var/log/messages
looks like I must have screwed something up in execve audit logging....
Looks like a duplicate of bz #433125.
i'll comment in 433125, but I don't see how this issue could cause programs to fail. execve logging is failing, but we aren't terminating the process or doing anything other than wasting huge amounts of cpu time/log space.
dwalsh told me on irc: auditctl -l LIST_RULES: exit,always watch=/etc/shadow perm=wa key=auth also I'm not seeing this on my latest git pulls from linus, so maybe its something fedora specific?
I'm obviously missing something as on my test machine: [root@dhcp231-146 ~]# uname -a Linux dhcp231-146.rdu.redhat.com 2.6.25-0.40.rc1.git2.fc9 #1 SMP Wed Feb 13 17:17:48 EST 2008 x86_64 x86_64 x86_64 GNU/Linux [root@dhcp231-146 ~]# auditctl -l LIST_RULES: exit,always watch=/etc/shadow perm=rw key=auth and I've got no problems. What do you actually have in /etc/audit/audit.rules? Maybe there is some rule that isn't showing up out of -l from the kernel somehow?
ok, its finally happening on my rawhide box with both fedora and stock git kernels from a couple hours ago. fully up2date rawhide setenforce 0 /etc/audit/audit.rules contains -w /etc/shadow -p wa -k auth reboot and watch it....
https://www.redhat.com/archives/linux-audit/2008-February/msg00010.html appears to fix it for me. until this heads upstream and back down we probably shouldn't be using audit rules :( audit rule + avc = boom.
The patch listed at 10 is now in the upstream kernel.