Re: Audit not recording the correct syscall return value in Fedora 10?

2009-05-08 Thread Paul Moore
On Thursday 07 May 2009 07:05:00 pm Tony Jones wrote: > On Tue, May 05, 2009 at 03:50:01PM -0400, Paul Moore wrote: > > No problem. As far as I'm aware the discussion never went beyond this > > thread as I was unable to recreate the problem with the (then) current > > kernels but it may not be a b

Re: Audit not recording the correct syscall return value in Fedora 10?

2009-05-07 Thread Tony Jones
On Tue, May 05, 2009 at 03:50:01PM -0400, Paul Moore wrote: > No problem. As far as I'm aware the discussion never went beyond this thread > as I was unable to recreate the problem with the (then) current kernels but > it > may not be a bad idea to get the arch folks and perhaps lkml involved

Re: Audit not recording the correct syscall return value in Fedora 10?

2009-05-05 Thread Paul Moore
On Tuesday 05 May 2009 03:34:43 pm Tony Jones wrote: > On Tue, May 05, 2009 at 03:20:52PM -0400, Paul Moore wrote: > > On Tuesday 05 May 2009 03:07:36 pm Tony Jones wrote: > > > On Tue, May 05, 2009 at 02:22:04PM -0400, Paul Moore wrote: > > > > I believe Matt Anderson (CC'd) reported the bug you a

Re: Audit not recording the correct syscall return value in Fedora 10?

2009-05-05 Thread Tony Jones
On Tue, May 05, 2009 at 03:20:52PM -0400, Paul Moore wrote: > On Tuesday 05 May 2009 03:07:36 pm Tony Jones wrote: > > On Tue, May 05, 2009 at 02:22:04PM -0400, Paul Moore wrote: > > > I believe Matt Anderson (CC'd) reported the bug you are referring to and > > > the workaround I posted seemed to f

Re: Audit not recording the correct syscall return value in Fedora 10?

2009-05-05 Thread Paul Moore
On Tuesday 05 May 2009 03:07:36 pm Tony Jones wrote: > On Tue, May 05, 2009 at 02:22:04PM -0400, Paul Moore wrote: > > I believe Matt Anderson (CC'd) reported the bug you are referring to and > > the workaround I posted seemed to fix the issue for him. I've stopped > > looking > > I'll check it ou

Re: Audit not recording the correct syscall return value in Fedora 10?

2009-05-05 Thread Tony Jones
On Tue, May 05, 2009 at 02:22:04PM -0400, Paul Moore wrote: > I believe Matt Anderson (CC'd) reported the bug you are referring to and the > workaround I posted seemed to fix the issue for him. I've stopped looking I'll check it out, I see the commit: 6d208da89aabee8502debe842832ca0ab298d16d T

Re: Audit not recording the correct syscall return value in Fedora 10?

2009-05-05 Thread Paul Moore
On Tuesday 05 May 2009 02:08:45 pm Tony Jones wrote: > On Tue, Apr 07, 2009 at 11:34:35AM -0400, Paul Moore wrote: > > While doing some testing on Fedora 10 using the 2.6.27.5-117.fc10.x86_64 > > kernel I stumbled across a rather odd problem: somewhere between the end > > of sys_sendto() and audit_

Re: Audit not recording the correct syscall return value in Fedora 10?

2009-05-05 Thread Tony Jones
On Tue, Apr 07, 2009 at 11:44:09PM -0300, Klaus Heinrich Kiwi wrote: > On Tue, 2009-04-07 at 11:34 -0400, Paul Moore wrote: > > Does anyone have any thoughts? > > I remember debugging an issue with the incorrect return value being > audited for a syscall. It was s390[x] specific and only occurred

Re: Audit not recording the correct syscall return value in Fedora 10?

2009-05-05 Thread Tony Jones
On Tue, Apr 07, 2009 at 11:34:35AM -0400, Paul Moore wrote: > While doing some testing on Fedora 10 using the 2.6.27.5-117.fc10.x86_64 > kernel I stumbled across a rather odd problem: somewhere between the end of > sys_sendto() and audit_syscall_exit() the syscall's return value was changing > r

Re: Audit not recording the correct syscall return value in Fedora 10?

2009-04-08 Thread Paul Moore
On Tuesday 07 April 2009 10:44:09 pm Klaus Heinrich Kiwi wrote: > On Tue, 2009-04-07 at 11:34 -0400, Paul Moore wrote: > > Does anyone have any thoughts? > > I remember debugging an issue with the incorrect return value being > audited for a syscall. It was s390[x] specific and only occurred with >

Re: Audit not recording the correct syscall return value in Fedora 10?

2009-04-07 Thread Klaus Heinrich Kiwi
On Tue, 2009-04-07 at 11:34 -0400, Paul Moore wrote: > Does anyone have any thoughts? I remember debugging an issue with the incorrect return value being audited for a syscall. It was s390[x] specific and only occurred with successful execve() syscalls. This behavior was pointed out with the open-

Audit not recording the correct syscall return value in Fedora 10?

2009-04-07 Thread Paul Moore
While doing some testing on Fedora 10 using the 2.6.27.5-117.fc10.x86_64 kernel I stumbled across a rather odd problem: somewhere between the end of sys_sendto() and audit_syscall_exit() the syscall's return value was changing resulting in incorrect audit records (similar problems with sys_sendm