From mboxrd@z Thu Jan  1 00:00:00 1970
From: Alexander Viro <aviro@redhat.com>
Subject: Re: [patch 058/209] audit: rework execve audit
Date: Fri, 27 Jul 2007 17:21:10 -0400
Message-ID: <20070727212110.GG13539@devserv.devel.redhat.com>
References: <200707190848.l6J8mFQf023098@imap1.linux-foundation.org>
	<200707271613.10753.sgrubb@redhat.com>
	<20070727210359.GF13539@devserv.devel.redhat.com>
	<200707271711.22499.sgrubb@redhat.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Return-path: <linux-audit-bounces@redhat.com>
Content-Disposition: inline
In-Reply-To: <200707271711.22499.sgrubb@redhat.com>
List-Unsubscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: Steve Grubb <sgrubb@redhat.com>
Cc: linux-audit@redhat.com, aaw@google.com, a.p.zijlstra@chello.nl
List-Id: linux-audit@redhat.com

On Fri, Jul 27, 2007 at 05:11:22PM -0400, Steve Grubb wrote:
> On Friday 27 July 2007 17:03:59 Alexander Viro wrote:
> > On Fri, Jul 27, 2007 at 04:13:10PM -0400, Steve Grubb wrote:
> > > WARNING: at kernel/auditsc.c:859 audit_log_execve_info() (Not tainted)
> > >
> > > Call Trace:
> > >  [<ffffffff8106b06f>] audit_log_exit+0x5d7/0x964
> > >  [<ffffffff81050805>] trace_hardirqs_on+0x12e/0x151
> > >  [<ffffffff8106b60b>] audit_syscall_exit+0x9b/0x300
> > >  [<ffffffff8100ee62>] syscall_trace_leave+0x2c/0x87
> > >  [<ffffffff8100beb1>] int_very_careful+0x3a/0x43
> >
> > Umm... which architecture?
> 
> Its the x86_64 kernel on a Turion64 processor.

I think I understand what's going on.  Test for execve failure in
there is bloody bogus.