Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755639AbdCLCZE (ORCPT ); Sat, 11 Mar 2017 21:25:04 -0500 Received: from mx1.redhat.com ([209.132.183.28]:60086 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755383AbdCLCYy (ORCPT ); Sat, 11 Mar 2017 21:24:54 -0500 From: Richard Guy Briggs To: linux-kernel@vger.kernel.org, linux-audit@redhat.com Cc: Richard Guy Briggs , Jessica Yu , Eric Paris , Paul Moore , Steve Grubb Subject: [PATCH v2] audit: log module name on delete_module Date: Sat, 11 Mar 2017 21:24:27 -0500 Message-Id: X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.31]); Sun, 12 Mar 2017 02:24:54 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1044 Lines: 31 When a sysadmin wishes to monitor module unloading with a syscall rule such as: -a always,exit -F arch=x86_64 -S delete_module -F key=mod-unload the SYSCALL record doesn't tell us what module was requested for unloading. Use the new KERN_MODULE auxiliary record to record it. The SYSCALL record result code will list the return code. See: https://github.com/linux-audit/audit-kernel/issues/37 https://github.com/linux-audit/audit-kernel/issues/7 https://github.com/linux-audit/audit-kernel/wiki/RFE-Module-Load-Record-Format Signed-off-by: Richard Guy Briggs --- kernel/module.c | 2 ++ 1 files changed, 2 insertions(+), 0 deletions(-) diff --git a/kernel/module.c b/kernel/module.c index 5432dbe..633f6da 100644 --- a/kernel/module.c +++ b/kernel/module.c @@ -943,6 +943,8 @@ SYSCALL_DEFINE2(delete_module, const char __user *, name_user, return -EFAULT; name[MODULE_NAME_LEN-1] = '\0'; + audit_log_kern_module(name); + if (mutex_lock_interruptible(&module_mutex) != 0) return -EINTR; -- 1.7.1