Auditd bug in 2.6.9 kernel

[Aaron Lewis]

Hi,

I'm running auditd 1.0.16 (compiled manually) with 2.6.9 kernel (RHEL4)

When I added a watch rule, e.g auditctl -w /usr/bin, all 32bit
programs get stuck:

$ strace /path/to/32bit_program
execve("XX", ["XX"], [/* 21 vars */]) = 0
[ Process PID=2901 runs in 32 bit mode. ]
uname(0xffffd880)                       = -1 EINTR (Interrupted system call)
open("/proc/sys/kernel/osrelease", O_RDONLY) = -1 EINTR (Interrupted
system call)
writev(2, [{"", 0}], 1)                 = -1 EINTR (Interrupted system call)
_exit(1)

Any ideas? Looks like a kernel-side bug.

-- 
Best Regards,
Aaron Lewis - PGP: 0x13714D33 - http://pgp.mit.edu/
Finger Print:   9F67 391B B770 8FF6 99DC  D92D 87F6 2602 1371 4D33