Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754816AbdCIOfg (ORCPT ); Thu, 9 Mar 2017 09:35:36 -0500 Received: from mx1.redhat.com ([209.132.183.28]:48804 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754706AbdCIOfL (ORCPT ); Thu, 9 Mar 2017 09:35:11 -0500 From: Richard Guy Briggs To: linux-kernel@vger.kernel.org, linux-audit@redhat.com Cc: Richard Guy Briggs , Jessica Yu , Eric Paris , Paul Moore , Steve Grubb Subject: [PATCH] audit: log module name on delete_module Date: Thu, 9 Mar 2017 09:08:40 -0500 Message-Id: X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.26]); Thu, 09 Mar 2017 14:09:12 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 616 Lines: 24 Record the module name of a delete_module call. See: https://github.com/linux-audit/audit-kernel/issues/37 Signed-off-by: Richard Guy Briggs --- kernel/module.c | 2 ++ 1 files changed, 2 insertions(+), 0 deletions(-) diff --git a/kernel/module.c b/kernel/module.c index 5432dbe..633f6da 100644 --- a/kernel/module.c +++ b/kernel/module.c @@ -943,6 +943,8 @@ SYSCALL_DEFINE2(delete_module, const char __user *, name_user, return -EFAULT; name[MODULE_NAME_LEN-1] = '\0'; + audit_log_kern_module(name); + if (mutex_lock_interruptible(&module_mutex) != 0) return -EINTR; -- 1.7.1