Bug#867486: Issue with the audit subsystem

[Laurent Bigonville <bigon@debian.org>]

Le 03/08/17 à 07:46, Salvatore Bonaccorso a écrit :
> Hi Laurent,

Hi,

> Sorry for the lack of time and no reply to this.
>
> On Fri, Jul 14, 2017 at 02:40:02PM +0200, Laurent Bigonville wrote:
> > Le 09/07/17 à 21:58, Salvatore Bonaccorso a écrit :
> > > Hi
> > Hi,
> >
> > > Unconfirmed, but the behaviour you are seen might be related to the
> > > changes which went in in 4.11 around
> > > 264d509637d95f9404e52ced5003ad352e0f6a26 .
> > >
> > > https://git.kernel.org/linus/264d509637d95f9404e52ced5003ad352e0f6a26
> > I posted on the linux-audit mailing list and I get the following reply from
> > Paul Moore:
> >
> > > On Mon, Jul 10, 2017 at 10:59 AM, Laurent Bigonville<bigon@debian.org>  wrote:
> > > > Hi,
> > > >
> > > > With 4.11.6 (that has been uploaded in debian unstable) I get a lot of
> > > > messages in dmesg like
> > > >
> > > > [100052.120468] audit: audit_lost=66041 audit_rate_limit=0
> > > > audit_backlog_limit=8192
> > > > [100052.120470] audit: kauditd hold queue overflow
> > > >
> > > > And it also seems that the messages are not stored in auditd logs anymore.
> > > >
> > > > https://git.kernel.org/linus/264d509637d95f9404e52ced5003ad352e0f6a26  seems
> > > > to be included in this release
> > > >
> > > > An idea?
> > > I'm going to assume that your backlog limit is set to a sane value for
> > > your system's configuration, so that leaves me with two commits that
> > > may be of interest:
> > >
> > > * 1df30f8264b8 ("audit: fix the RCU locking for the auditd_connection
> > > structure")
> > >
> > > This was a manual backport of a v4.12 patch to v4.11, looking now, I
> > > see it should be in +v4.11.5 so that probably isn't your problem ...
> > >
> > > * c81be52a3ac0 ("audit: fix a race condition with the auditd tracking code")
> > >
> > > This patch is relatively new and was just sent up to Linus during the
> > > next merge window; it's a race condition fix so reproducing it can be
> > > tricky, although it may be easily reproducible on your system at the
> > > moment (luck you!).  If you aren't in a position to apply the patch,
> > > the workaround is rather simple: restart auditd.
> > >
> > > If none of the above works, let me know, but I strongly suspect you're
> > > tripping over the race condition fixed in that last patch.
> > I still should test the last patch he mentioned
> Did you manage to test the last patch he mentioned? And does it
> resolve the issue?
I didn't had the time to recompile the kernel with that patch included.

I can just confirm that it still happening with the kernel currently in 
experimental (4.12.2-1~exp1)