From mboxrd@z Thu Jan 1 00:00:00 1970 From: Paul Moore Subject: Re: Audit not recording the correct syscall return value in Fedora 10? Date: Fri, 8 May 2009 09:22:23 -0400 Message-ID: <200905080922.23210.paul.moore@hp.com> References: <200904071134.35379.paul.moore@hp.com> <200905051550.01946.paul.moore@hp.com> <20090507230500.GA24658@suse.de> Mime-Version: 1.0 Content-Type: Text/Plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Return-path: Received: from mx3.redhat.com (mx3.redhat.com [172.16.48.32]) by int-mx1.corp.redhat.com (8.13.1/8.13.1) with ESMTP id n48DMfkf011789 for ; Fri, 8 May 2009 09:22:41 -0400 Received: from g1t0026.austin.hp.com (g1t0026.austin.hp.com [15.216.28.33]) by mx3.redhat.com (8.13.8/8.13.8) with ESMTP id n48DMQr3024667 for ; Fri, 8 May 2009 09:22:26 -0400 In-Reply-To: <20090507230500.GA24658@suse.de> Content-Disposition: inline List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Tony Jones Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Thursday 07 May 2009 07:05:00 pm Tony Jones wrote: > On Tue, May 05, 2009 at 03:50:01PM -0400, Paul Moore wrote: > > No problem. As far as I'm aware the discussion never went beyond this > > thread as I was unable to recreate the problem with the (then) current > > kernels but it may not be a bad idea to get the arch folks and perhaps > > lkml involved if we can narrow this down a little. > > Doesn't reproduce for me with 2.6.30-rc4-git1. Well, since neither one of us can reproduce it on recent kernels it looks like the root cause either went away, the problem was resolved or we are just getting lucky with a timing windows somewhere. Sigh. I guess I should just be happy it is no longer happening :) > For our SLES11 kernel (2.6.27+patches) I needed your entry_64.S change to > fix the problem. I also wonder about other arches, heck, even 32 bit x86. > With just commit 6d208da89aabee8502debe842832ca0ab298d16d I get: > > [snippet] [snippet snipped] Yes, I wouldn't expect the above commit to resolve the modprobe issue that Matt reported since init_module returns an int. The commit above should only matter when the syscall returns a 64 bit value (long, etc.) on a 64 bit system. -- paul moore linux @ hp