Re: [RFC][PATCH 1/3] (#7U1) file system auditing
On Thu, 2005-04-21 at 22:46 +0000, Timothy R. Chavez wrote:
Updated patches... Please patch, compile and give a quick test so we
can push
this all to LKML. Please be weary, these haven't been tested on an SMP
machine yet. I'm hoping my changes fixed the deadlock issue, though.
[PATCH 1/3]
At the bottom of this message, below the changelog, is the kernel patch for
file systeming auditing diffed against linux-2.6.12-mm2-rc1
Oopses for me upon auditctl -l with the updated auditctl.
Apr 22 11:27:51 moss-huskers kernel: eip: c014602a
Apr 22 11:27:51 moss-huskers kernel: ------------[ cut here ]------------
Apr 22 11:27:51 moss-huskers kernel: kernel BUG at include/asm/spinlock.h:136!
Apr 22 11:27:51 moss-huskers kernel: invalid operand: 0000 [#1]
Apr 22 11:27:51 moss-huskers kernel: SMP
Apr 22 11:27:51 moss-huskers kernel: Modules linked in: radeon parport_pc lp parport
autofs4 i2c_dev i2c_core nfs lockd sunrpc ipt_REJECT ipt_state ip_conntrack iptable_filter
ip_tables dm_mod video hotkey button battery ac md5 ipv6 uhci_hcd snd_intel8x0m
snd_intel8x0 snd_ac97_codec snd_pcm_oss snd_mixer_oss snd_pcm snd_timer snd soundcore
snd_page_alloc 3c59x mii floppy ext3 jbd
Apr 22 11:27:51 moss-huskers kernel: CPU: 0
Apr 22 11:27:51 moss-huskers kernel: EIP: 0060:[<c0334919>] Not tainted VLI
Apr 22 11:27:51 moss-huskers kernel: EFLAGS: 00010292 (2.6.12-rc2-mm1)
Apr 22 11:27:51 moss-huskers kernel: EIP is at _spin_lock+0x39/0x50
Apr 22 11:27:51 moss-huskers kernel: eax: 00000011 ebx: c049bd14 ecx: c0387a04 edx:
00000200
Apr 22 11:27:51 moss-huskers kernel: esi: 00000000 edi: 00000001 ebp: f0f6cca0 esp:
f0f6cc94
Apr 22 11:27:51 moss-huskers kernel: ds: 007b es: 007b ss: 0068
Apr 22 11:27:51 moss-huskers kernel: Process auditctl (pid: 16028, threadinfo=f0f6c000
task=f7c52550)
Apr 22 11:27:51 moss-huskers kernel: Stack: c0349739 c014602a f3d93800 f0f6ccc8 c014602a
f0f6ccfc f0f6cd10 c01c81e0
Apr 22 11:27:51 moss-huskers kernel: 00400000 00003e9c f3d93800 f25d2680 000003ea
f0f6cd2c c01434a0 f1e11200
Apr 22 11:27:51 moss-huskers kernel: 00000000 00000000 00000000 00000000 00000000
03ea0000 00000000 f3d93810
Apr 22 11:27:51 moss-huskers kernel: Call Trace:
Apr 22 11:27:51 moss-huskers kernel: [<c010505a>] show_stack+0x7a/0x90
Apr 22 11:27:51 moss-huskers kernel: [<c01051e2>] show_registers+0x152/0x1d0
Apr 22 11:27:51 moss-huskers kernel: [<c01053fd>] die+0xed/0x170
Apr 22 11:27:51 moss-huskers kernel: [<c01057f5>] do_invalid_op+0xa5/0xb0
Apr 22 11:27:51 moss-huskers kernel: [<c0104c93>] error_code+0x4f/0x54
Apr 22 11:27:51 moss-huskers kernel: [<c014602a>] audit_list_watches+0x1a/0x80
Apr 22 11:27:51 moss-huskers kernel: [<c01434a0>] audit_receive_msg+0x90/0x290
Apr 22 11:27:51 moss-huskers kernel: [<c01436d5>] audit_receive_skb+0x35/0x80
Apr 22 11:27:51 moss-huskers kernel: [<c0143757>] audit_receive+0x37/0xc0
Apr 22 11:27:51 moss-huskers kernel: [<c02e33c2>] netlink_data_ready+0x52/0x60
Apr 22 11:27:51 moss-huskers kernel: [<c02e2723>] netlink_sendskb+0x23/0x70
Apr 22 11:27:51 moss-huskers kernel: [<c02e30dd>] netlink_sendmsg+0x25d/0x2e0
Apr 22 11:27:51 moss-huskers kernel: [<c02c4727>] sock_sendmsg+0xe7/0x110
Apr 22 11:27:51 moss-huskers kernel: [<c02c5c2b>] sys_sendto+0xcb/0xf0
Apr 22 11:27:51 moss-huskers kernel: [<c02c64d2>] sys_socketcall+0x182/0x230
Apr 22 11:27:51 moss-huskers kernel: [<c01040b3>] sysenter_past_esp+0x54/0x75
Apr 22 11:27:51 moss-huskers kernel: Code: ad de 75 14 f0 fe 0b 79 09 f3 90 80 3b 00 7e f9
eb f2 83 c4 08 5b 5d c3 c7 04 24 39 97 34 c0 8b 45 04 89 44 24 04
e8 a7 f8 de ff <0f> 0b 88 00 76 8e 34 c0 eb cf 8d b6 00 00 00 00 8d bc 27 00 00
--
Stephen Smalley <sds(a)tycho.nsa.gov>
National Security Agency