Re: Audit not recording the correct syscall return value in Fedora 10?

On Tue, Apr 07, 2009 at 11:34:35AM -0400, Paul Moore wrote: > While doing some testing on Fedora 10 using the 2.6.27.5-117.fc10.x86_64 > kernel I stumbled across a rather odd problem: somewhere between the end > of sys_sendto() and audit_syscall_exit() the syscall's return value was > changing resulting in incorrect audit records (similar problems with > sys_sendmsg()). After some head scratching and debugging I determined > that the %rax register was being altered at some point and if we reloaded > the syscall's return value from the stack before calling > audit_syscall_exit() we could avoid the problem (see patch below). > > I also tried to reproduce the problem with a vanilla 2.6.29.1 kernel and > after several hours of testing I have yet to see the problem using the > newer, upstream kernel. Taking a look at the entry_64.S files of the two > kernels there appear to be a number of changes, the most significant are > the tracing changes but I'm not familiar enough with this chunk of code > to identify the definitive root cause (although, tracing changes does > sound reasonable). > > Does anyone have any thoughts? I have seen a similar issue with the init_module syscall on x86_64. I have an open bug on it. for i in `seq 1 100`; do cat /dev/null > /var/log/audit/audit.log ; rmmod dummy ; rcauditd restart ; auditctl -a entry,always -S init_module ; modprobe dummy ; ausearch -c modprobe; done Randomly you'll get a bogus return code in audit, on a DL375 needed 1000 iter to reproduce. type=SYSCALL msg=audit(1235061247.598:22697): arch=c000003e syscall=175 success=no exit=1490771928 a0=7fe11dc61000 a1=1e08 a2=61a1e0 a3=61a1e0 items=0 ppid=31342 pid=8313 auid=1001 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts3 ses=2 comm="modprobe" exe="/sbin/modprobe" key=(null) I keep meaning to get back to debugging it.