Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1596186

Re: [PATCH] audit: log module name on delete_module

Show all headers | View raw

On 2017-03-09 16:15, peter enderborg wrote:
> On 03/09/2017 03:08 PM, Richard Guy Briggs wrote:
> > Record the module name of a delete_module call.
> >
> > See: https://github.com/linux-audit/audit-kernel/issues/37
> >
> > Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
> > ---
> >  kernel/module.c |    2 ++
> >  1 files changed, 2 insertions(+), 0 deletions(-)
> >
> > diff --git a/kernel/module.c b/kernel/module.c
> > index 5432dbe..633f6da 100644
> > --- a/kernel/module.c
> > +++ b/kernel/module.c
> > @@ -943,6 +943,8 @@ SYSCALL_DEFINE2(delete_module, const char __user *, name_user,
> >  		return -EFAULT;
> >  	name[MODULE_NAME_LEN-1] = '\0';
> >  
> > +	audit_log_kern_module(name);
> > +
> >  	if (mutex_lock_interruptible(&module_mutex) != 0)
> >  		return -EINTR;
> 
> Is it not better to have that log when we are sure that the module
> will be deleted and are stopped?

We went to know what module deletion was attempted.  The return code in
the syscall record will tell us whether or not it succeeded and if it
failed, with which error.

- RGB

--
Richard Guy Briggs <rgb@redhat.com>
Kernel Security Engineering, Base Operating Systems, Red Hat
Remote, Ottawa, Canada
Voice: +1.647.777.2635, Internal: (81) 32635

Back to linux.kernel | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

[PATCH] audit: log module name on delete_module Richard Guy Briggs <rgb@redhat.com> - 2017-03-09 15:40 +0100
  Re: [PATCH] audit: log module name on delete_module Miroslav Benes <mbenes@suse.cz> - 2017-03-09 16:00 +0100
    Re: [PATCH] audit: log module name on delete_module Paul Moore <paul@paul-moore.com> - 2017-03-10 00:10 +0100
  Re: [PATCH] audit: log module name on delete_module peter enderborg <peter.enderborg@sonymobile.com> - 2017-03-09 16:20 +0100
    Re: [PATCH] audit: log module name on delete_module Richard Guy Briggs <rgb@redhat.com> - 2017-03-09 17:30 +0100

csiph-web