This seems to be some combination of Xen and the audit subsystem, but
the attached program crashes my machine 100% of the time.
steps to reproduce the crash:
* 1) compile with gcc -m32
* 2) start auditd, install any rule (I've only tested syscall
auditing, but any syscall seems to work).
* /etc/init.d/auditd start ; auditctl -D ; auditctl -a
exit,always -F arch=64 -S chmod
* 3) run'n wait (this only loops twice for me before dying)
* ./a.out
* 4) bask in instantaneous kernel oops.
It's running 2.6.38.8 (but I've seen this bug all the way up to
3.5.0-rc7, the latest I've tested). It's a fairly beefy setup, 32G
memory and 6 cpus.
It's a little bit funky in that it's a 64 bit system and a 32 bit
binary, but something about that 64 bit/32 bit mismatch and the fact
that this is not running on bare metal leads to a crash 100% of the
time.
Any one have any idea what's going on?
Cheers,
peter
--
Peter Moody Google 1.650.253.7306
Security Engineer pgp:0xC3410038