Re. 2.6.15-mm1

[David Woodhouse]

On Fri, 2006-01-06 at 11:18 +0100, Etienne Lorrain wrote:
> > Please could you tell me the line of code which corresponds to
> > '__audit_inode+0xba/0x190'? Assuming your kernel was compiled
> > with debugging information, you can do this by loading your
> > vmlinux into gdb and issuing the command
> > 'list *__audit_inode+0xba'.
> 
>   I'll do that tonight, but I probably have to recompile.

OK, thanks. You shouldn't necessarily need to reproduce the problem;
just recompiling the offending file with identical CFLAGS (except of
course for adding -g) should suffice. 

You can remove kernel/auditsc.o from your kernel tree, then run 'make
V=1' and it'll show you the precise gcc command line it uses to rebuild
that file. Cut and paste that command line, and add '-g' to it.

Then load the resulting object file into gdb and use the 'list' command
I showed. Ideally, check that the disassembly of that part of the file
really does match the Code: line in your oops -- but I'll ask you do to
that if it looks suspicious.

> > What audit rules had you entered? You shouldn't be seeing
> > this code path unless you've actually enabled auditing
> > for yourself.
> 
>   I did not touch the Fedora Core 4 configuration, I am sorry
>  I do not have a clue of even where to find those rules - I
>  did not read enough about this subject.

While I'm pleased it's helping us find a bug, it's quite unacceptable
that auditing was enabled on your system without your knowledge. It's an
esoteric requirement and enabling it makes the system much less
efficient. Please file a bug against the Fedora distribution.

-- 
dwmw2