Date: Thu, 9 Mar 2017 11:18:45 -0500
From: Richard Guy Briggs <rgb@redhat.com>
To: peter enderborg <peter.enderborg@sonymobile.com>
Cc: linux-kernel@vger.kernel.org, linux-audit@redhat.com,
        Jessica Yu <jeyu@redhat.com>
Subject: Re: [PATCH] audit: log module name on delete_module
Message-ID: <20170309161845.GN3818@madcap2.tricolour.ca>
References: <a6c97cf45849b9d132b1ed0b7415b04968302325.1489068452.git.rgb@redhat.com>
 <f6c4c1e5-906b-ada4-93a2-fc75d61307cc@sonymobile.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <f6c4c1e5-906b-ada4-93a2-fc75d61307cc@sonymobile.com>
User-Agent: Mutt/1.5.21 (2010-09-15)
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 1233
Lines: 38

On 2017-03-09 16:15, peter enderborg wrote:
> On 03/09/2017 03:08 PM, Richard Guy Briggs wrote:
> > Record the module name of a delete_module call.
> >
> > See: https://github.com/linux-audit/audit-kernel/issues/37
> >
> > Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
> > ---
> >  kernel/module.c |    2 ++
> >  1 files changed, 2 insertions(+), 0 deletions(-)
> >
> > diff --git a/kernel/module.c b/kernel/module.c
> > index 5432dbe..633f6da 100644
> > --- a/kernel/module.c
> > +++ b/kernel/module.c
> > @@ -943,6 +943,8 @@ SYSCALL_DEFINE2(delete_module, const char __user *, name_user,
> >  		return -EFAULT;
> >  	name[MODULE_NAME_LEN-1] = '\0';
> >  
> > +	audit_log_kern_module(name);
> > +
> >  	if (mutex_lock_interruptible(&module_mutex) != 0)
> >  		return -EINTR;
> 
> Is it not better to have that log when we are sure that the module
> will be deleted and are stopped?

We went to know what module deletion was attempted.  The return code in
the syscall record will tell us whether or not it succeeded and if it
failed, with which error.

- RGB

--
Richard Guy Briggs <rgb@redhat.com>
Kernel Security Engineering, Base Operating Systems, Red Hat
Remote, Ottawa, Canada
Voice: +1.647.777.2635, Internal: (81) 32635