linux-kernel - Re: [PATCH] audit: log module name on delete_module

Open Source and information security mailing list archives

Message-ID: <CAHC9VhSVwJR42TWxcz+iUNKMMGbVrgHVJEoh6+h3_LaQ502gJQ@mail.gmail.com>
Date:   Thu, 9 Mar 2017 18:02:47 -0500
From:   Paul Moore <paul@...l-moore.com>
To:     Richard Guy Briggs <rgb@...hat.com>,
        Miroslav Benes <mbenes@...e.cz>
Cc:     Jessica Yu <jeyu@...hat.com>, linux-kernel@...r.kernel.org,
        linux-audit@...hat.com
Subject: Re: [PATCH] audit: log module name on delete_module

On Thu, Mar 9, 2017 at 9:49 AM, Miroslav Benes <mbenes@...e.cz> wrote:
> On Thu, 9 Mar 2017, Richard Guy Briggs wrote:
>
>> Record the module name of a delete_module call.
>>
>> See: https://github.com/linux-audit/audit-kernel/issues/37
>>
>> Signed-off-by: Richard Guy Briggs <rgb@...hat.com>
>
> Could you improve the changelog, please? I don't think that a link to
> a github issue can and should replace it. Proper description and reason of
> the change should be in git log.

Agreed.  While I think it is nice that Richard included the GitHub
issue tracker link, the commit message needs to stand on it's own
describing the change.  The GitHub issue is an optional piece of
information which links to the development history and extended
information not normally suitable for a commit message.

>> ---
>>  kernel/module.c |    2 ++
>>  1 files changed, 2 insertions(+), 0 deletions(-)
>>
>> diff --git a/kernel/module.c b/kernel/module.c
>> index 5432dbe..633f6da 100644
>> --- a/kernel/module.c
>> +++ b/kernel/module.c
>> @@ -943,6 +943,8 @@ SYSCALL_DEFINE2(delete_module, const char __user *, name_user,
>>               return -EFAULT;
>>       name[MODULE_NAME_LEN-1] = '\0';
>>
>> +     audit_log_kern_module(name);
>> +
>>       if (mutex_lock_interruptible(&module_mutex) != 0)
>>               return -EINTR;
>>
>> --
>> 1.7.1
>>
>
> --
> Linux-audit mailing list
> Linux-audit@...hat.com
> https://www.redhat.com/mailman/listinfo/linux-audit

-- 
paul moore
www.paul-moore.com

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives