Audit not recording the correct syscall return value in Fedora 10?

Paul Moore paul.moore at hp.com
Fri May 8 13:22:23 UTC 2009


On Thursday 07 May 2009 07:05:00 pm Tony Jones wrote:
> On Tue, May 05, 2009 at 03:50:01PM -0400, Paul Moore wrote:
> > No problem.  As far as I'm aware the discussion never went beyond this
> > thread as I was unable to recreate the problem with the (then) current
> > kernels but it may not be a bad idea to get the arch folks and perhaps
> > lkml involved if we can narrow this down a little.
>
> Doesn't reproduce for me with 2.6.30-rc4-git1.

Well, since neither one of us can reproduce it on recent kernels it looks like 
the root cause either went away, the problem was resolved or we are just 
getting lucky with a timing windows somewhere.  Sigh.

I guess I should just be happy it is no longer happening :)

> For our SLES11 kernel (2.6.27+patches) I needed your entry_64.S change to
> fix the problem.

I also wonder about other arches, heck, even 32 bit x86.

> With just commit 6d208da89aabee8502debe842832ca0ab298d16d I get:
>
> [snippet]

[snippet snipped]

Yes, I wouldn't expect the above commit to resolve the modprobe issue that 
Matt reported since init_module returns an int.  The commit above should only 
matter when the syscall returns a 64 bit value (long, etc.) on a 64 bit 
system.

-- 
paul moore
linux @ hp




More information about the Linux-audit mailing list