From: Steve Grubb <sgrubb@redhat.com>
To: Richard Guy Briggs <rgb@redhat.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
        LKML <linux-kernel@vger.kernel.org>,
        Steven Rostedt <rostedt@goodmis.org>,
        Linux-Audit Mailing List <linux-audit@redhat.com>,
        Al Viro <viro@zeniv.linux.org.uk>, Ingo Molnar <mingo@redhat.com>,
        Jessica Yu <jeyu@redhat.com>
Subject: Re: Hundreds of null PATH records for *init_module syscall audit logs
Date: Thu, 09 Mar 2017 08:24:05 -0500
Message-ID: <1528289.CZOIOPGIO4@x2>
Organization: Red Hat
In-Reply-To: <20170303211454.GK3818@madcap2.tricolour.ca>
References: <20170301031549.GT18258@madcap2.tricolour.ca> <2137861.7RBAWtfTXJ@x2> <20170303211454.GK3818@madcap2.tricolour.ca>
MIME-Version: 1.0
Content-Transfer-Encoding: 7Bit
Content-Type: text/plain; charset="us-ascii"
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 1009
Lines: 24

On Friday, March 3, 2017 4:14:54 PM EST Richard Guy Briggs wrote:
> > > > 1 - In __audit_inode_child, return immedialy upon detecting TRACEFS
> > > > and
> > > > 
> > > > DEBUGFS (and potentially other filesystems identified, via s_magic).
> > 
> > XFS creates them too. Who knows what else.
> 
> Why would this happen?  I would assume it is a mounted filesystem.  Do
> you have a sample of the extra records?

I can't find them right away. But I've seen them.

> This brings me back to the original reaction I had to your suggestion
> which is: Are you certain there is never a circumstance where *_module
> syscalls never involve a file?  Say, the module itself on loading pulls
> in other files from the mounted filesystem?

We don't care about this. Audit events have to tell a story. They must have a 
subject, action, and object. In this case its "somebody loaded a kernel module 
X". Where X is the module name. Paths are irrelevant to the story and just 
make it hard to understand the event.

-Steve