audit.49 kernel

[Timothy R. Chavez]

On Wednesday 25 May 2005 11:01, Steve Grubb wrote:
> On Wednesday 25 May 2005 10:26, David Woodhouse wrote:
> > - auditfs update (Tim Chavez)
> 
> This kernel survived inserting rules better. However, it got into a state 
> where I couldn't insert rules anymore. I couldn't delete them either. I got 
> the "no such path" error message. So I decided to reboot and see how to 
> reproduce it. On shutdown, it spewed these messages:
> 
> May 25 11:48:22 localhost kernel: audit(1117036102.346:3047572):  watch="" 
> filterkey=fk_passwd perm=15 perm_mask=4 inode=214331 inode_uid=0 inode_gid=0 
> inode_dev=03:02 inode_rdev=00:00
> May 25 11:48:22 localhost kernel: audit(1117036102.346:3047572): item=0 
> name="/etc/passwd" inode=214331 dev=03:02 mode=0100644 ouid=0 ogid=0 
> rdev=00:00
> 
> Then I got a kernel panic. I wrote these down by hand so its not complete:
> EIP 0060
> EIP is at audit_update_watch+0x17d/0x2bc
> Process mount (pid:4580
> Call trace:
> 	shrink_dcache_sb
> 	do_remount_sb
> 	do_remount
> 	__alloc_pages
> 	sys_mount
> 
> Kernel panic - not syncing  lib/dec_and_lock.c:32  
> spinlock(fs/dcache.c:c0352ee0) already locked by fs/dcache.c/377

Schnikies.  That's awfully suspicious.  I'll look into this after lunch

-tim

> 
> I'll try to work out the recipe to reproduce this failure.
> 
> -Steve
> 
> --
> Linux-audit mailing list
> Linux-audit at redhat.com
> http://www.redhat.com/mailman/listinfo/linux-audit
> 
>