Re: Hundreds of null PATH records for *init_module syscall audit logs

From	Steven Rostedt <rostedt@goodmis.org>
Newsgroups	linux.kernel
Subject	Re: Hundreds of null PATH records for *init_module syscall audit logs
Date	2017-03-07 21:50 +0100
Message-ID	<tisbD-31Z-21@gated-at.bofh.it> (permalink)
References	(3 earlier) <ties2-1uN-9@gated-at.bofh.it> <tipGN-1c1-13@gated-at.bofh.it> <tiq9Q-1Dp-17@gated-at.bofh.it> <tiq9Q-1Dp-15@gated-at.bofh.it> <tirpf-2s0-7@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Tue, 7 Mar 2017 12:39:55 -0500
Richard Guy Briggs <rgb@redhat.com> wrote:

> We normally don't expect the init_module syscall to have any PATH
> records associated with it, so when a few of them had hundreds or more
> this was surprising.

Hmm, how does the syscall get a path associated to it? Just by its
creation? That is, by calling init_module() which would load a module,
would indeed create a path. Some modules do create their own debugfs
files, which would explain why debugfs is shown too.

> 
> If there is a way that debugfs or tracefs could be abused during an
> init_module call (or any other syscall for that matter), we want to be
> aware of it.  This is why simply ignoring those PATH records is making
> two of us nervous.

If there's a bug in the kernel code, then I'm sure there's probably a
way to abuse it.

I also don't believe it should be ignored, which is why I'm asking
these questions. I want to know what exactly is being looked at, and
what is considered "OK" and what isn't.

Now loading modules can indeed create files and directories. Is this
something that the audit system needs to understand?

-- Steve

Thread

Re: Hundreds of null PATH records for *init_module syscall audit logs Paul Moore <paul@paul-moore.com> - 2017-03-04 01:30 +0100
  Re: Hundreds of null PATH records for *init_module syscall audit logs Richard Guy Briggs <rgb@redhat.com> - 2017-03-07 05:00 +0100
    Re: Hundreds of null PATH records for *init_module syscall audit  logs Steven Rostedt <rostedt@goodmis.org> - 2017-03-07 17:00 +0100
      Re: Hundreds of null PATH records for *init_module syscall audit  logs Steven Rostedt <rostedt@goodmis.org> - 2017-03-07 17:30 +0100
        Re: Hundreds of null PATH records for *init_module syscall audit logs Richard Guy Briggs <rgb@redhat.com> - 2017-03-07 18:50 +0100
          Re: Hundreds of null PATH records for *init_module syscall audit logs Richard Guy Briggs <rgb@redhat.com> - 2017-03-07 19:40 +0100
            Re: Hundreds of null PATH records for *init_module syscall audit  logs Steven Rostedt <rostedt@goodmis.org> - 2017-03-07 20:20 +0100
              Re: Hundreds of null PATH records for *init_module syscall audit logs Richard Guy Briggs <rgb@redhat.com> - 2017-03-07 23:30 +0100
          Re: Hundreds of null PATH records for *init_module syscall audit  logs Steven Rostedt <rostedt@goodmis.org> - 2017-03-07 21:50 +0100
      Re: Hundreds of null PATH records for *init_module syscall audit logs Richard Guy Briggs <rgb@redhat.com> - 2017-03-07 17:30 +0100
        Re: Hundreds of null PATH records for *init_module syscall audit logs Steve Grubb <sgrubb@redhat.com> - 2017-03-09 14:40 +0100
  Re: Hundreds of null PATH records for *init_module syscall audit  logs Steven Rostedt <rostedt@goodmis.org> - 2017-03-07 16:40 +0100

csiph-web