Date: Tue, 7 Mar 2017 10:37:27 -0500
From: Steven Rostedt <rostedt@goodmis.org>
To: Paul Moore <paul@paul-moore.com>
Cc: Richard Guy Briggs <rgb@redhat.com>,
        Linux-Audit Mailing List <linux-audit@redhat.com>,
        LKML <linux-kernel@vger.kernel.org>,
        Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
        Ingo Molnar <mingo@redhat.com>, Al Viro <viro@zeniv.linux.org.uk>
Subject: Re: Hundreds of null PATH records for *init_module syscall audit
 logs
Message-ID: <20170307103727.78661e8a@gandalf.local.home>
In-Reply-To: <CAHC9VhRMo411HNzQ99u3w=ewegYMDMkavcD0OHOZ6Og2U7TdKA@mail.gmail.com>
References: <20170301031549.GT18258@madcap2.tricolour.ca>
        <20170301033704.GU18258@madcap2.tricolour.ca>
        <CAHC9VhRMo411HNzQ99u3w=ewegYMDMkavcD0OHOZ6Og2U7TdKA@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 2418
Lines: 53

On Fri, 3 Mar 2017 19:19:47 -0500
Paul Moore <paul@paul-moore.com> wrote:

> On Tue, Feb 28, 2017 at 10:37 PM, Richard Guy Briggs <rgb@redhat.com> wrote:
> > Sorry, I forgot to include Cc: in this cover letter for context to the 4
> > alt patches.
> >
> > On 2017-02-28 22:15, Richard Guy Briggs wrote:  
> >> The background to this is:
> >>       https://github.com/linux-audit/audit-kernel/issues/8
> >>
> >> In short, audit SYSCALL records for *init_module were occasionally
> >> accompanied by hundreds to thousands of null PATH records.
> >>
> >> I chatted with Al Viro and Eric Paris about this Friday afternoon and
> >> they seemed to vaguely recall this issue and didn't have any solid
> >> recommendations as to what was the right thing to do (other than the
> >> same suggestion from both that I won't print here).
> >>
> >> It was reproducible on a number of vintages of distributions with
> >> default kernels, but triggering on very few of the many modules loaded
> >> at boot time.  It was reproduced with fs-nfs4 and nfsv4 modules on
> >> tracefs, but there are reports of it also happening with debugfs.  It
> >> was triggering only in __audit_inode_child with a parent that was not
> >> found in the task context's audit names_list.  
> 
> I'm no expert on the tracing system, but my understanding is that it
> used to use debugfs but now prefers tracefs so perhaps depending on
> the vintage of the kernel/userspace you will see it on either debugfs
> or tracefs.  I'm also guessing that module load order may have an
> effect, maybe not.

Note, when you mount debugfs, it automounts tracefs in debugfs/tracing.

Userspace can also mount tracefs without debugfs. But tracing does not
use debugfs anymore, even though it appears in the debugfs directory.

> 
> >> I have four potential solutions listed in my order of preference and I'd
> >> like to get some feedback about which one would be the most acceptable.  
> 
> >From an audit perspective, I'm generally not a fan of throwing away  
> information, especially since solution #4 seems to provide some basic
> PATH information.  Although I guess the issue is do we care about
> tracefs/debugfs PATH records?


I don't have enough context here to really understand what the issue
is. Is there a problem when modules have trace events and when they are
loaded, these trace events create files and directories in the tracefs
file system?

-- Steve