aureport endless loop with specific input on Debian 8

aureport endless loop with specific input on Debian 8

[Vincas Dargis]

Hi,

I have reported bug in Debian bug tracker [1] that after upgrading to Debian 8, aureport does not finish it's 
"reporting" for hours one some inputs, generated by ausearch. It's stuck with 100% CPU usage.

Since maintainer haven't responded yet, I though I could try for help directly here.

More info, and two example input files for reproducing attached in same bug report.

I wonder, would it be... "reasonable" to hope for some kind isolated patch that Debian maintainer could apply and 
release fix for Debian 8 which is currently in "stable" mode? I know it's kinda not the mailing list to ask about it, 
but maybe you have experience in that regard?

Thanks!

[1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=841272

Re: aureport endless loop with specific input on Debian 8

[Steve Grubb]

On Sat, 5 Nov 2016 15:05:32 +0200
Vincas Dargis <vindrg@gmail.com> wrote:
> I have reported bug in Debian bug tracker [1] that after upgrading to
> Debian 8, aureport does not finish it's "reporting" for hours one
> some inputs, generated by ausearch. It's stuck with 100% CPU usage.

If I read that correctly, this is against audit-2.4. There was linked
list fixes to ausearch/report in 2.4.4. I suspect that fixes your bug
report. Its not reproducible with the latest version.

-Steve

 
> Since maintainer haven't responded yet, I though I could try for help
> directly here.
> 
> More info, and two example input files for reproducing attached in
> same bug report.
> 
> I wonder, would it be... "reasonable" to hope for some kind isolated
> patch that Debian maintainer could apply and release fix for Debian 8
> which is currently in "stable" mode? I know it's kinda not the
> mailing list to ask about it, but maybe you have experience in that
> regard?
> 
> Thanks!
> 
> [1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=841272
> 
> --
> Linux-audit mailing list
> Linux-audit@redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit

Re: aureport endless loop with specific input on Debian 8

[Steve Grubb]

On Sat, 5 Nov 2016 14:37:02 +0000
Steve Grubb <sgrubb@redhat.com> wrote:

> On Sat, 5 Nov 2016 15:05:32 +0200
> Vincas Dargis <vindrg@gmail.com> wrote:
> > I have reported bug in Debian bug tracker [1] that after upgrading
> > to Debian 8, aureport does not finish it's "reporting" for hours one
> > some inputs, generated by ausearch. It's stuck with 100% CPU
> > usage.  
> 
> If I read that correctly, this is against audit-2.4. There was linked
> list fixes to ausearch/report in 2.4.4. I suspect that fixes your bug
> report. Its not reproducible with the latest version.

Pretty sure this is the fix:
https://fedorahosted.org/audit/changeset?format=diff&new=1116&old=1114&new_path=%2Ftrunk&old_path=%2Ftrunk

-Steve


> > Since maintainer haven't responded yet, I though I could try for
> > help directly here.
> > 
> > More info, and two example input files for reproducing attached in
> > same bug report.
> > 
> > I wonder, would it be... "reasonable" to hope for some kind isolated
> > patch that Debian maintainer could apply and release fix for Debian
> > 8 which is currently in "stable" mode? I know it's kinda not the
> > mailing list to ask about it, but maybe you have experience in that
> > regard?
> > 
> > Thanks!
> > 
> > [1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=841272
> > 
> > --
> > Linux-audit mailing list
> > Linux-audit@redhat.com
> > https://www.redhat.com/mailman/listinfo/linux-audit  
> 
> --
> Linux-audit mailing list
> Linux-audit@redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit

Re: aureport endless loop with specific input on Debian 8

[Vincas Dargis]

2016.11.05 19:30, Steve Grubb wrote:
> Pretty sure this is the fix:
> https://fedorahosted.org/audit/changeset?format=diff&new=1116&old=1114&new_path=%2Ftrunk&old_path=%2Ftrunk

Thanks! I'll try to convince maintainer to add this patch.