This seems to be some combination of Xen and the audit subsystem, but the attached program crashes my machine 100% of the time. steps to reproduce the crash: * 1) compile with gcc -m32 * 2) start auditd, install any rule (I've only tested syscall auditing, but any syscall seems to work). * /etc/init.d/auditd start ; auditctl -D ; auditctl -a exit,always -F arch=64 -S chmod * 3) run'n wait (this only loops twice for me before dying) * ./a.out * 4) bask in instantaneous kernel oops. It's running 2.6.38.8 (but I've seen this bug all the way up to 3.5.0-rc7, the latest I've tested). It's a fairly beefy setup, 32G memory and 6 cpus. It's a little bit funky in that it's a 64 bit system and a 32 bit binary, but something about that 64 bit/32 bit mismatch and the fact that this is not running on bare metal leads to a crash 100% of the time. Any one have any idea what's going on? Cheers, peter -- Peter Moody Google 1.650.253.7306 Security Engineer pgp:0xC3410038