Re: [RFC][PATCH] (#7U4) file system auditing by location and name

On Friday 06 May 2005 17:16, Timothy R. Chavez wrote: I installed the .31 kernel. I then ran: auditctl -w /etc/passwd -k fk_passwd -p rwea I got this: May 7 09:35:02 localhost kernel: CPU: 0 May 7 09:35:02 localhost kernel: EIP: 0060:[<c014baf7>] Not tainted VLI May 7 09:35:02 localhost kernel: EFLAGS: 00210046 (2.6.9-5.0.3.EL.audit.31) May 7 09:35:02 localhost kernel: EIP is at kmem_cache_alloc+0x25/0x4c May 7 09:35:02 localhost kernel: eax: 00000080 ebx: 000000d0 ecx: 00000000 edx: e273a000 May 7 09:35:02 localhost kernel: esi: 00200246 edi: 00000000 ebp: ed99e410 esp: e273ac04 May 7 09:35:02 localhost kernel: ds: 007b es: 007b ss: 0068 May 7 09:35:02 localhost kernel: Process auditctl (pid: 9301, threadinfo=e273a000 task=e8aec880) May 7 09:35:02 localhost kernel: Stack: ffffffea 000003ef ea4f6e00 c0141a69 ffffffea 000003ef ea4f6e00 000010e5 May 7 09:35:02 localhost kernel: c01421a5 00000007 00000000 f084b332 ef08d764 00000001 d14995cc 000001bb May 7 09:35:02 localhost kernel: eef3355c eef3355c eef3355c eef3355c 00800000 c01c00f2 00000000 000001bb May 7 09:35:02 localhost kernel: Call Trace: May 7 09:35:02 localhost kernel: [<c0141a69>] audit_to_watch+0x15/0xc0 May 7 09:35:02 localhost kernel: [<c01421a5>] audit_receive_watch+0x3e/0x309 May 7 09:35:02 localhost kernel: [<f084b332>] __journal_file_buffer+0x10f/0x1e8 [jbd] May 7 09:35:02 localhost kernel: [<c01c00f2>] avc_has_perm_noaudit+0x8d/0xda May 7 09:35:02 localhost kernel: [<f084b332>] __journal_file_buffer+0x10f/0x1e8 [jbd] May 7 09:35:02 localhost kernel: [<c01c017a>] avc_has_perm+0x3b/0x45 May 7 09:35:02 localhost kernel: [<c013f66f>] audit_receive_msg+0x238/0x25c May 7 09:35:02 localhost kernel: [<c013f6c5>] audit_receive_skb+0x32/0x70 May 7 09:35:02 localhost kernel: [<c013f72b>] audit_receive+0x28/0x7d May 7 09:35:02 localhost kernel: [<c02bc636>] netlink_data_ready+0x14/0x43 May 7 09:35:02 localhost kernel: [<c02bbd35>] netlink_sendskb+0x52/0x6b May 7 09:35:02 localhost kernel: [<c02bc452>] netlink_sendmsg+0x267/0x276 May 7 09:35:02 localhost kernel: [<c029eb3b>] sock_sendmsg+0xdb/0xf7 May 7 09:35:02 localhost kernel: [<c0147179>] buffered_rmqueue+0x1c4/0x1e7 May 7 09:35:02 localhost kernel: [<c0147250>] __alloc_pages+0xb4/0x298 May 7 09:35:02 localhost kernel: [<c015321d>] do_anonymous_page+0x215/0x27f May 7 09:35:02 localhost kernel: [<c011d04b>] autoremove_wake_function+0x0/0x2d May 7 09:35:02 localhost kernel: [<c029fe4b>] sys_sendto+0xc7/0xe2 May 7 09:35:02 localhost kernel: [<c01193e9>] do_page_fault+0x1ac/0x4dc May 7 09:35:02 localhost kernel: [<c029e8b6>] sock_map_file+0x98/0x106 May 7 09:35:03 localhost kernel: [<c01547e3>] __vma_link+0x59/0x66 May 7 09:35:03 localhost kernel: [<c01548d1>] vma_link+0xe1/0x1dd May 7 09:35:03 localhost kernel: [<c02a0644>] sys_socketcall+0x14c/0x1dd May 7 09:35:03 localhost kernel: [<c030336f>] syscall_call+0x7/0xb May 7 09:35:03 localhost kernel: Code: 5d e9 6e eb 08 00 57 f6 c2 10 89 c7 56 53 89 d3 74 16 31 c9 ba 0f 08 00 00 b8 f4 3f 31 c0 e8 cc 0e fd ff e8 36 60 1b 00 9c 5e fa <8b> 17 8b 02 85 c0 74 10 c7 42 0c 01 00 00 00 48 89 02 8b 44 82 At this point, I would recommend that we fix this patch without any updates to re-mediate problems Al Viro found. I was planning to release 0.7.4 as soon as I can successfully test that we can insert, remove, and list watches. -Steve