Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752334AbdCCWZ3 (ORCPT ); Fri, 3 Mar 2017 17:25:29 -0500 Received: from mx1.redhat.com ([209.132.183.28]:50396 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752099AbdCCWZ2 (ORCPT ); Fri, 3 Mar 2017 17:25:28 -0500 From: Richard Guy Briggs To: linux-kernel@vger.kernel.org, linux-audit@redhat.com Cc: Richard Guy Briggs , Jessica Yu , Steven Rostedt , Ingo Molnar , Greg Kroah-Hartman , Al Viro , Eric Paris , Paul Moore , Steve Grubb Subject: [PATCH ALT5] audit: ignore module syscalls on inode child Date: Fri, 3 Mar 2017 17:24:37 -0500 Message-Id: In-Reply-To: <20170303211454.GK3818@madcap2.tricolour.ca> References: <20170303211454.GK3818@madcap2.tricolour.ca> X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.39]); Fri, 03 Mar 2017 22:25:28 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1026 Lines: 36 Tracefs or debugfs were causing hundreds to thousands of null PATH records to be associated with the init_module and finit_module SYSCALL records on a few modules when the following rule was in place for startup: -a always,exit -F arch=x86_64 -S init_module -F key=mod-load In __audit_inode_child, return immedialy upon detecting module-related syscalls. See https://github.com/linux-audit/audit-kernel/issues/8 Test case: https://github.com/linux-audit/audit-testsuite/issues/42 Signed-off-by: Richard Guy Briggs --- kernel/auditsc.c | 6 ++++++ 1 files changed, 6 insertions(+), 0 deletions(-) diff --git a/kernel/auditsc.c b/kernel/auditsc.c index 4db32e8..d7fe943 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -1868,6 +1868,12 @@ void __audit_inode_child(struct inode *parent, if (!context->in_syscall) return; + switch (context->major) { + case __NR_init_module: + case __NR_delete_module: + case __NR_finit_module: + return; + } if (inode) handle_one(inode); -- 1.7.1