Re: audit.49 kernel

On Wednesday 25 May 2005 10:26, David Woodhouse wrote: > - auditfs update (Tim Chavez) This kernel survived inserting rules better. However, it got into a state where I couldn't insert rules anymore. I couldn't delete them either. I got the "no such path" error message. So I decided to reboot and see how to reproduce it. On shutdown, it spewed these messages: May 25 11:48:22 localhost kernel: audit(1117036102.346:3047572): watch="" filterkey=fk_passwd perm=15 perm_mask=4 inode=214331 inode_uid=0 inode_gid=0 inode_dev=03:02 inode_rdev=00:00 May 25 11:48:22 localhost kernel: audit(1117036102.346:3047572): item=0 name="/etc/passwd" inode=214331 dev=03:02 mode=0100644 ouid=0 ogid=0 rdev=00:00 Then I got a kernel panic. I wrote these down by hand so its not complete: EIP 0060 EIP is at audit_update_watch+0x17d/0x2bc Process mount (pid:4580 Call trace: shrink_dcache_sb do_remount_sb do_remount __alloc_pages sys_mount Kernel panic - not syncing lib/dec_and_lock.c:32 spinlock(fs/dcache.c:c0352ee0) already locked by fs/dcache.c/377

I'll try to work out the recipe to reproduce this failure. -Steve -- Linux-audit mailing list Linux-audit(a)redhat.com http://www.redhat.com/mailman/listinfo/linux-audit