2017-03-09 14:35:36

by Richard Guy Briggs

Subject: [PATCH] audit: log module name on delete_module

Record the module name of a delete_module call.

See: https://github.com/linux-audit/audit-kernel/issues/37

Signed-off-by: Richard Guy Briggs <[email protected]>
---
kernel/module.c | 2 ++
1 files changed, 2 insertions(+), 0 deletions(-)

diff --git a/kernel/module.c b/kernel/module.c
index 5432dbe..633f6da 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -943,6 +943,8 @@ SYSCALL_DEFINE2(delete_module, const char __user *, name_user,
return -EFAULT;
name[MODULE_NAME_LEN-1] = '\0';

+ audit_log_kern_module(name);
+
if (mutex_lock_interruptible(&module_mutex) != 0)
return -EINTR;

--
1.7.1

2017-03-09 14:50:35

by Miroslav Benes

Subject: Re: [PATCH] audit: log module name on delete_module

On Thu, 9 Mar 2017, Richard Guy Briggs wrote:

> Record the module name of a delete_module call.
>
> See: https://github.com/linux-audit/audit-kernel/issues/37
>
> Signed-off-by: Richard Guy Briggs <[email protected]>

Could you improve the changelog, please? I don't think that a link to
a github issue can and should replace it. Proper description and reason of
the change should be in git log.

Thanks,
Miroslav

> ---
> kernel/module.c | 2 ++
> 1 files changed, 2 insertions(+), 0 deletions(-)
>
> diff --git a/kernel/module.c b/kernel/module.c
> index 5432dbe..633f6da 100644
> --- a/kernel/module.c
> +++ b/kernel/module.c
> @@ -943,6 +943,8 @@ SYSCALL_DEFINE2(delete_module, const char __user *, name_user,
> return -EFAULT;
> name[MODULE_NAME_LEN-1] = '\0';
>
> + audit_log_kern_module(name);
> +
> if (mutex_lock_interruptible(&module_mutex) != 0)
> return -EINTR;
>
> --
> 1.7.1
>

2017-03-09 15:15:46

by peter enderborg

Subject: Re: [PATCH] audit: log module name on delete_module

On 03/09/2017 03:08 PM, Richard Guy Briggs wrote:
> Record the module name of a delete_module call.
>
> See: https://github.com/linux-audit/audit-kernel/issues/37
>
> Signed-off-by: Richard Guy Briggs <[email protected]>
> ---
> kernel/module.c | 2 ++
> 1 files changed, 2 insertions(+), 0 deletions(-)
>
> diff --git a/kernel/module.c b/kernel/module.c
> index 5432dbe..633f6da 100644
> --- a/kernel/module.c
> +++ b/kernel/module.c
> @@ -943,6 +943,8 @@ SYSCALL_DEFINE2(delete_module, const char __user *, name_user,
> return -EFAULT;
> name[MODULE_NAME_LEN-1] = '\0';
>
> + audit_log_kern_module(name);
> +
> if (mutex_lock_interruptible(&module_mutex) != 0)
> return -EINTR;
>

Is it not better to have that log when we are sure that the module will be deleted and are stopped?

2017-03-09 16:27:14

by Richard Guy Briggs

Subject: Re: [PATCH] audit: log module name on delete_module

On 2017-03-09 16:15, peter enderborg wrote:
> On 03/09/2017 03:08 PM, Richard Guy Briggs wrote:
> > Record the module name of a delete_module call.
> >
> > See: https://github.com/linux-audit/audit-kernel/issues/37
> >
> > Signed-off-by: Richard Guy Briggs <[email protected]>
> > ---
> > kernel/module.c | 2 ++
> > 1 files changed, 2 insertions(+), 0 deletions(-)
> >
> > diff --git a/kernel/module.c b/kernel/module.c
> > index 5432dbe..633f6da 100644
> > --- a/kernel/module.c
> > +++ b/kernel/module.c
> > @@ -943,6 +943,8 @@ SYSCALL_DEFINE2(delete_module, const char __user *, name_user,
> > return -EFAULT;
> > name[MODULE_NAME_LEN-1] = '\0';
> >
> > + audit_log_kern_module(name);
> > +
> > if (mutex_lock_interruptible(&module_mutex) != 0)
> > return -EINTR;
>
> Is it not better to have that log when we are sure that the module
> will be deleted and are stopped?

We went to know what module deletion was attempted. The return code in
the syscall record will tell us whether or not it succeeded and if it
failed, with which error.

- RGB

--
Richard Guy Briggs <[email protected]>
Kernel Security Engineering, Base Operating Systems, Red Hat
Remote, Ottawa, Canada
Voice: +1.647.777.2635, Internal: (81) 32635

2017-03-09 23:02:50

by Paul Moore

Subject: Re: [PATCH] audit: log module name on delete_module

On Thu, Mar 9, 2017 at 9:49 AM, Miroslav Benes <[email protected]> wrote:
> On Thu, 9 Mar 2017, Richard Guy Briggs wrote:
>
>> Record the module name of a delete_module call.
>>
>> See: https://github.com/linux-audit/audit-kernel/issues/37
>>
>> Signed-off-by: Richard Guy Briggs <[email protected]>
>
> Could you improve the changelog, please? I don't think that a link to
> a github issue can and should replace it. Proper description and reason of
> the change should be in git log.

Agreed. While I think it is nice that Richard included the GitHub
issue tracker link, the commit message needs to stand on it's own
describing the change. The GitHub issue is an optional piece of
information which links to the development history and extended
information not normally suitable for a commit message.

>> ---
>> kernel/module.c | 2 ++
>> 1 files changed, 2 insertions(+), 0 deletions(-)
>>
>> diff --git a/kernel/module.c b/kernel/module.c
>> index 5432dbe..633f6da 100644
>> --- a/kernel/module.c
>> +++ b/kernel/module.c
>> @@ -943,6 +943,8 @@ SYSCALL_DEFINE2(delete_module, const char __user *, name_user,
>> return -EFAULT;
>> name[MODULE_NAME_LEN-1] = '\0';
>>
>> + audit_log_kern_module(name);
>> +
>> if (mutex_lock_interruptible(&module_mutex) != 0)
>> return -EINTR;
>>
>> --
>> 1.7.1
>>
>
> --
> Linux-audit mailing list
> [email protected]
> https://www.redhat.com/mailman/listinfo/linux-audit

--
paul moore
http://www.paul-moore.com