Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1596107 > unrolled thread

[PATCH] audit: log module name on delete_module

Back to article view | Back to linux.kernel

Contents

  [PATCH] audit: log module name on delete_module Richard Guy Briggs <rgb@redhat.com> - 2017-03-09 15:40 +0100
    Re: [PATCH] audit: log module name on delete_module Miroslav Benes <mbenes@suse.cz> - 2017-03-09 16:00 +0100
      Re: [PATCH] audit: log module name on delete_module Paul Moore <paul@paul-moore.com> - 2017-03-10 00:10 +0100
    Re: [PATCH] audit: log module name on delete_module peter enderborg <peter.enderborg@sonymobile.com> - 2017-03-09 16:20 +0100
      Re: [PATCH] audit: log module name on delete_module Richard Guy Briggs <rgb@redhat.com> - 2017-03-09 17:30 +0100

#1596107 — [PATCH] audit: log module name on delete_module

Record the module name of a delete_module call.

See: https://github.com/linux-audit/audit-kernel/issues/37

Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
---
 kernel/module.c |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)

diff --git a/kernel/module.c b/kernel/module.c
index 5432dbe..633f6da 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -943,6 +943,8 @@ SYSCALL_DEFINE2(delete_module, const char __user *, name_user,
 		return -EFAULT;
 	name[MODULE_NAME_LEN-1] = '\0';
 
+	audit_log_kern_module(name);
+
 	if (mutex_lock_interruptible(&module_mutex) != 0)
 		return -EINTR;
 
-- 
1.7.1

[toc] | [next] | [standalone]

#1596128

On Thu, 9 Mar 2017, Richard Guy Briggs wrote:

> Record the module name of a delete_module call.
> 
> See: https://github.com/linux-audit/audit-kernel/issues/37
> 
> Signed-off-by: Richard Guy Briggs <rgb@redhat.com>

Could you improve the changelog, please? I don't think that a link to 
a github issue can and should replace it. Proper description and reason of 
the change should be in git log.

Thanks,
Miroslav

> ---
>  kernel/module.c |    2 ++
>  1 files changed, 2 insertions(+), 0 deletions(-)
> 
> diff --git a/kernel/module.c b/kernel/module.c
> index 5432dbe..633f6da 100644
> --- a/kernel/module.c
> +++ b/kernel/module.c
> @@ -943,6 +943,8 @@ SYSCALL_DEFINE2(delete_module, const char __user *, name_user,
>  		return -EFAULT;
>  	name[MODULE_NAME_LEN-1] = '\0';
>  
> +	audit_log_kern_module(name);
> +
>  	if (mutex_lock_interruptible(&module_mutex) != 0)
>  		return -EINTR;
>  
> -- 
> 1.7.1
> 

[toc] | [prev] | [next] | [standalone]

#1596462

On Thu, Mar 9, 2017 at 9:49 AM, Miroslav Benes <mbenes@suse.cz> wrote:
> On Thu, 9 Mar 2017, Richard Guy Briggs wrote:
>
>> Record the module name of a delete_module call.
>>
>> See: https://github.com/linux-audit/audit-kernel/issues/37
>>
>> Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
>
> Could you improve the changelog, please? I don't think that a link to
> a github issue can and should replace it. Proper description and reason of
> the change should be in git log.

Agreed.  While I think it is nice that Richard included the GitHub
issue tracker link, the commit message needs to stand on it's own
describing the change.  The GitHub issue is an optional piece of
information which links to the development history and extended
information not normally suitable for a commit message.

>> ---
>>  kernel/module.c |    2 ++
>>  1 files changed, 2 insertions(+), 0 deletions(-)
>>
>> diff --git a/kernel/module.c b/kernel/module.c
>> index 5432dbe..633f6da 100644
>> --- a/kernel/module.c
>> +++ b/kernel/module.c
>> @@ -943,6 +943,8 @@ SYSCALL_DEFINE2(delete_module, const char __user *, name_user,
>>               return -EFAULT;
>>       name[MODULE_NAME_LEN-1] = '\0';
>>
>> +     audit_log_kern_module(name);
>> +
>>       if (mutex_lock_interruptible(&module_mutex) != 0)
>>               return -EINTR;
>>
>> --
>> 1.7.1
>>
>
> --
> Linux-audit mailing list
> Linux-audit@redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit

-- 
paul moore
www.paul-moore.com

[toc] | [prev] | [next] | [standalone]

#1596150

On 03/09/2017 03:08 PM, Richard Guy Briggs wrote:
> Record the module name of a delete_module call.
>
> See: https://github.com/linux-audit/audit-kernel/issues/37
>
> Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
> ---
>  kernel/module.c |    2 ++
>  1 files changed, 2 insertions(+), 0 deletions(-)
>
> diff --git a/kernel/module.c b/kernel/module.c
> index 5432dbe..633f6da 100644
> --- a/kernel/module.c
> +++ b/kernel/module.c
> @@ -943,6 +943,8 @@ SYSCALL_DEFINE2(delete_module, const char __user *, name_user,
>  		return -EFAULT;
>  	name[MODULE_NAME_LEN-1] = '\0';
>  
> +	audit_log_kern_module(name);
> +
>  	if (mutex_lock_interruptible(&module_mutex) != 0)
>  		return -EINTR;
>  

Is it not better to have that log when we are sure that the module will be deleted and are stopped?

[toc] | [prev] | [next] | [standalone]

#1596186

On 2017-03-09 16:15, peter enderborg wrote:
> On 03/09/2017 03:08 PM, Richard Guy Briggs wrote:
> > Record the module name of a delete_module call.
> >
> > See: https://github.com/linux-audit/audit-kernel/issues/37
> >
> > Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
> > ---
> >  kernel/module.c |    2 ++
> >  1 files changed, 2 insertions(+), 0 deletions(-)
> >
> > diff --git a/kernel/module.c b/kernel/module.c
> > index 5432dbe..633f6da 100644
> > --- a/kernel/module.c
> > +++ b/kernel/module.c
> > @@ -943,6 +943,8 @@ SYSCALL_DEFINE2(delete_module, const char __user *, name_user,
> >  		return -EFAULT;
> >  	name[MODULE_NAME_LEN-1] = '\0';
> >  
> > +	audit_log_kern_module(name);
> > +
> >  	if (mutex_lock_interruptible(&module_mutex) != 0)
> >  		return -EINTR;
> 
> Is it not better to have that log when we are sure that the module
> will be deleted and are stopped?

We went to know what module deletion was attempted.  The return code in
the syscall record will tell us whether or not it succeeded and if it
failed, with which error.

- RGB

--
Richard Guy Briggs <rgb@redhat.com>
Kernel Security Engineering, Base Operating Systems, Red Hat
Remote, Ottawa, Canada
Voice: +1.647.777.2635, Internal: (81) 32635

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web