linux-kernel - restorecond going crazy on 2.6.31.4

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:	Thu, 15 Oct 2009 18:03:04 -0600
From:	Robert Hancock <hancockrwd@...il.com>
To:	linux-kernel <linux-kernel@...r.kernel.org>
CC:	"Rafael J. Wysocki" <rjw@...k.pl>
Subject: restorecond going crazy on 2.6.31.4 - inotify regression?

I just upgraded to 2.6.31.4 on a CentOS 5.3 x86_64 machine, and noticed 
the SELinux restorecond daemon using 100% CPU. Previously it was running 
2.6.30.7 which didn't have this problem. It looks like it's triggered by 
either opening or closing a gnome-terminal. strace on restorecond shows 
the following repeating continuously

inotify_add_watch(3, "/var/run/utmp", IN_MODIFY|IN_MOVED_FROM) = 9
read(3, "\t\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0", 32768) = 16
write(1, "wd=9 mask=32768 cookie=0 len=0\n", 31wd=9 mask=32768 cookie=0 
len=0
) = 31
open("/var/run/utmp", O_RDONLY)         = 4
fstat(4, {st_mode=S_IFREG|0664, st_size=5760, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) 
= 0x7fe0d938c000
read(4, 
"\10\0\0\0\177\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4096) 
= 4096
read(4, 
"\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 
4096) = 1664
read(4, "", 4096)                       = 0
close(4)                                = 0
munmap(0x7fe0d938c000, 4096)            = 0
inotify_rm_watch(3, 9)                  = 0
inotify_add_watch(3, "/var/run/utmp", IN_MODIFY|IN_MOVED_FROM) = 9

It looks like it's getting continuous notifications that /var/run/utmp 
has changed, which seems a bit odd. I know there were some inotify 
issues in the 2.6.31 series, is there something still amiss?
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/