RE: Re: OpenAFS 1.8.7 on Linux systems running Crowdstrike falcon-sensor

On Sun, Mar 7, 2021 at 4:34 PM Benjamin Kaduk <mailto:[email protected]> wrote:
> > I don't use Crowdstrike so haven't seen it, but can you post the backtrace?

> Based on what I've heard from Mr. Proulx at MIT (and from others off-list), I have put in a ticket with Crowdstrike asking if I can share the kernel backtrace.  I honestly feel like it should be OK but I don't want to risk my job over it.

Hi,

I’m an engineer at CrowdStrike. There is a known issue in which OpenAFS can cause the CrowdStrike LSM to crash because current->fs can be set to NULL in a certain code path in which it should not be NULL because we’re in process context. I double-checked this on the upstream LSM mailing list after looking at a stack trace. I had thought that a bug report had gotten back to OpenAFS but it seems like that didn’t happen; sorry about that!

Below is the LKML LSM thread regarding this. Please let me know if you have any other questions:

https://www.spinics.net/lists/linux-security-module/msg39081.html
https://www.spinics.net/lists/linux-security-module/msg39083.html