From mboxrd@z Thu Jan 1 00:00:00 1970 From: Paul Moore Subject: Re: v3.19-rc2: crashes during boot (syslog-ng, rpcbind ...) Date: Mon, 29 Dec 2014 14:41:59 -0500 Message-ID: <4182091.odzUCAWhED@sifl> References: <54A17C49.5080102@gmx.de> <54A18046.9060209@gmx.de> Mime-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: QUOTED-PRINTABLE Return-path: In-Reply-To: <54A18046.9060209@gmx.de> Sender: linux-kernel-owner@vger.kernel.org To: Toralf =?ISO-8859-1?Q?F=F6rster?= Cc: linux Kernel , linux-audit@redhat.com List-Id: linux-audit@redhat.com On Monday, December 29, 2014 05:24:38 PM Toralf F=F6rster wrote: > On 12/29/2014 05:21 PM, Paul Moore wrote: > > On Mon, Dec 29, 2014 at 11:07 AM, Toralf F=F6rster wrote: > >> A x86 KVM guest running at a 64 bit Gentoo hardened host system th= e > >> following crashes appeared reproducible (screen shots attached. > >>=20 > >> If I removed syslog-ng from the runlevel default, then the crash j= ust > >> appeared a little bit later at another subsystem>=20 > > > > It looks like it doesn't like something in audit_compare_dname_path= (); > > I'll take a look and see what I can find, there is a patch in -rc2 > > which touched some related code. > >=20 > > I didn't see this problem in my earlier testing, can you share your > > .config? > > ofc - attached [NOTE: added linux-audit to the CC line, I should have done that earlie= r] I believe I can reproduce this now; I'm seeing slightly different panic= s, but=20 it is "close enough" and based on some quality time with the code I bel= ieve=20 they are both symptoms of the same root cause. To help verify that I'm heading down the right path, could you share yo= ur=20 audit configuration as well? If that's not possible, can you at least = confirm=20 that you using a few audit directory watches? --=20 paul moore www.paul-moore.com