On Mon, Apr 30, 2012 at 07:55:32PM +0100, Jon Masters wrote:

But I'll look over your patch and do some poking. Now that we know where
this problem is, I think the priority is for me to test this patch from
you (took the day off, but I'll give it a test tonight) to make sure
nothing blows up, then schedule some time for audit to make sure it's
actually doing anything useful. I'll email you later today. Still
leaning toward recommending nobody actually turn on audit on ARM systems
until we know that it doesn't do anything else that's terrible.

Well this might make you smile.

The original audit code blew up the ARM kernel because it assumed a big-endian
target, which we since fixed. However, it looks like the userspace audit tools
only support ARMEB, so I've not been able to get them working on my board.
Linaro even had the heart to package them up nicely in their v7l filesystem!

I doubt it's much effort to fix the tools, but it implies nobody is using
them on armv7l today and turning it off is probably your safest bet for the time
being.

Will