Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1598533 > unrolled thread
| Started by | Richard Guy Briggs <rgb@redhat.com> |
|---|---|
| First post | 2017-03-12 03:30 +0100 |
| Last post | 2017-03-15 21:00 +0100 |
| Articles | 4 — 3 participants |
Back to article view | Back to linux.kernel
[PATCH v2] audit: log module name on delete_module Richard Guy Briggs <rgb@redhat.com> - 2017-03-12 03:30 +0100
Re: [PATCH v2] audit: log module name on delete_module Paul Moore <paul@paul-moore.com> - 2017-03-13 15:20 +0100
Re: [PATCH v2] audit: log module name on delete_module Jessica Yu <jeyu@redhat.com> - 2017-03-13 17:40 +0100
Re: [PATCH v2] audit: log module name on delete_module Paul Moore <paul@paul-moore.com> - 2017-03-15 21:00 +0100
| From | Richard Guy Briggs <rgb@redhat.com> |
|---|---|
| Date | 2017-03-12 03:30 +0100 |
| Subject | [PATCH v2] audit: log module name on delete_module |
| Message-ID | <tk1qG-3is-5@gated-at.bofh.it> |
When a sysadmin wishes to monitor module unloading with a syscall rule such as:
-a always,exit -F arch=x86_64 -S delete_module -F key=mod-unload
the SYSCALL record doesn't tell us what module was requested for unloading.
Use the new KERN_MODULE auxiliary record to record it.
The SYSCALL record result code will list the return code.
See: https://github.com/linux-audit/audit-kernel/issues/37
https://github.com/linux-audit/audit-kernel/issues/7
https://github.com/linux-audit/audit-kernel/wiki/RFE-Module-Load-Record-Format
Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
---
kernel/module.c | 2 ++
1 files changed, 2 insertions(+), 0 deletions(-)
diff --git a/kernel/module.c b/kernel/module.c
index 5432dbe..633f6da 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -943,6 +943,8 @@ SYSCALL_DEFINE2(delete_module, const char __user *, name_user,
return -EFAULT;
name[MODULE_NAME_LEN-1] = '\0';
+ audit_log_kern_module(name);
+
if (mutex_lock_interruptible(&module_mutex) != 0)
return -EINTR;
--
1.7.1
[toc] | [next] | [standalone]
| From | Paul Moore <paul@paul-moore.com> |
|---|---|
| Date | 2017-03-13 15:20 +0100 |
| Message-ID | <tkyZk-1HR-19@gated-at.bofh.it> |
| In reply to | #1598533 |
On Sat, Mar 11, 2017 at 9:24 PM, Richard Guy Briggs <rgb@redhat.com> wrote: > When a sysadmin wishes to monitor module unloading with a syscall rule such as: > -a always,exit -F arch=x86_64 -S delete_module -F key=mod-unload > the SYSCALL record doesn't tell us what module was requested for unloading. > > Use the new KERN_MODULE auxiliary record to record it. > The SYSCALL record result code will list the return code. > > See: https://github.com/linux-audit/audit-kernel/issues/37 > https://github.com/linux-audit/audit-kernel/issues/7 > https://github.com/linux-audit/audit-kernel/wiki/RFE-Module-Load-Record-Format > > Signed-off-by: Richard Guy Briggs <rgb@redhat.com> > --- > kernel/module.c | 2 ++ > 1 files changed, 2 insertions(+), 0 deletions(-) Jessica? If there are no objections to this patch on your side I'll merge this into the audit/next tree. > diff --git a/kernel/module.c b/kernel/module.c > index 5432dbe..633f6da 100644 > --- a/kernel/module.c > +++ b/kernel/module.c > @@ -943,6 +943,8 @@ SYSCALL_DEFINE2(delete_module, const char __user *, name_user, > return -EFAULT; > name[MODULE_NAME_LEN-1] = '\0'; > > + audit_log_kern_module(name); > + > if (mutex_lock_interruptible(&module_mutex) != 0) > return -EINTR; > > -- > 1.7.1 > > -- > Linux-audit mailing list > Linux-audit@redhat.com > https://www.redhat.com/mailman/listinfo/linux-audit -- paul moore www.paul-moore.com
[toc] | [prev] | [next] | [standalone]
| From | Jessica Yu <jeyu@redhat.com> |
|---|---|
| Date | 2017-03-13 17:40 +0100 |
| Message-ID | <tkBaP-3bi-41@gated-at.bofh.it> |
| In reply to | #1599418 |
+++ Paul Moore [13/03/17 10:16 -0400]: >On Sat, Mar 11, 2017 at 9:24 PM, Richard Guy Briggs <rgb@redhat.com> wrote: >> When a sysadmin wishes to monitor module unloading with a syscall rule such as: >> -a always,exit -F arch=x86_64 -S delete_module -F key=mod-unload >> the SYSCALL record doesn't tell us what module was requested for unloading. >> >> Use the new KERN_MODULE auxiliary record to record it. >> The SYSCALL record result code will list the return code. >> >> See: https://github.com/linux-audit/audit-kernel/issues/37 >> https://github.com/linux-audit/audit-kernel/issues/7 >> https://github.com/linux-audit/audit-kernel/wiki/RFE-Module-Load-Record-Format >> >> Signed-off-by: Richard Guy Briggs <rgb@redhat.com> >> --- >> kernel/module.c | 2 ++ >> 1 files changed, 2 insertions(+), 0 deletions(-) > >Jessica? If there are no objections to this patch on your side I'll >merge this into the audit/next tree. Looks good to me: Acked-by: Jessica Yu <jeyu@redhat.com> >> diff --git a/kernel/module.c b/kernel/module.c >> index 5432dbe..633f6da 100644 >> --- a/kernel/module.c >> +++ b/kernel/module.c >> @@ -943,6 +943,8 @@ SYSCALL_DEFINE2(delete_module, const char __user *, name_user, >> return -EFAULT; >> name[MODULE_NAME_LEN-1] = '\0'; >> >> + audit_log_kern_module(name); >> + >> if (mutex_lock_interruptible(&module_mutex) != 0) >> return -EINTR; >> >> -- >> 1.7.1 >> >> -- >> Linux-audit mailing list >> Linux-audit@redhat.com >> https://www.redhat.com/mailman/listinfo/linux-audit > >-- >paul moore >www.paul-moore.com
[toc] | [prev] | [next] | [standalone]
| From | Paul Moore <paul@paul-moore.com> |
|---|---|
| Date | 2017-03-15 21:00 +0100 |
| Message-ID | <tlnft-3Ul-37@gated-at.bofh.it> |
| In reply to | #1599583 |
On Mon, Mar 13, 2017 at 12:31 PM, Jessica Yu <jeyu@redhat.com> wrote: > +++ Paul Moore [13/03/17 10:16 -0400]: >> >> On Sat, Mar 11, 2017 at 9:24 PM, Richard Guy Briggs <rgb@redhat.com> >> wrote: >>> >>> When a sysadmin wishes to monitor module unloading with a syscall rule >>> such as: >>> -a always,exit -F arch=x86_64 -S delete_module -F key=mod-unload >>> the SYSCALL record doesn't tell us what module was requested for >>> unloading. >>> >>> Use the new KERN_MODULE auxiliary record to record it. >>> The SYSCALL record result code will list the return code. >>> >>> See: https://github.com/linux-audit/audit-kernel/issues/37 >>> https://github.com/linux-audit/audit-kernel/issues/7 >>> >>> https://github.com/linux-audit/audit-kernel/wiki/RFE-Module-Load-Record-Format >>> >>> Signed-off-by: Richard Guy Briggs <rgb@redhat.com> >>> --- >>> kernel/module.c | 2 ++ >>> 1 files changed, 2 insertions(+), 0 deletions(-) >> >> >> Jessica? If there are no objections to this patch on your side I'll >> merge this into the audit/next tree. > > > Looks good to me: > > Acked-by: Jessica Yu <jeyu@redhat.com> Merged, thanks everyone. -- paul moore www.paul-moore.com
[toc] | [prev] | [standalone]
Back to top | Article view | linux.kernel
csiph-web