linux-kernel - Re: [PATCH v2] audit,module: restore audit logging in load failure case

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAHC9VhRhr0GMQB59DZ4-xJ788yEgAsUMBLNdYFL2UxioBUPhGQ@mail.gmail.com>
Date: Tue, 22 Apr 2025 12:30:01 -0400
From: Paul Moore <paul@...l-moore.com>
To: Richard Guy Briggs <rgb@...hat.com>
Cc: Linux-Audit Mailing List <linux-audit@...ts.linux-audit.osci.io>, 
	LKML <linux-kernel@...r.kernel.org>, linux-modules@...r.kernel.org, 
	Linux Kernel Audit Mailing List <audit@...r.kernel.org>, Eric Paris <eparis@...isplace.org>
Subject: Re: [PATCH v2] audit,module: restore audit logging in load failure case

On Tue, Apr 22, 2025 at 11:37 AM Richard Guy Briggs <rgb@...hat.com> wrote:
> On 2025-04-11 14:23, Paul Moore wrote:
> > On Mar 17, 2025 Richard Guy Briggs <rgb@...hat.com> wrote:

...

> > > diff --git a/kernel/module/main.c b/kernel/module/main.c
> > > index 1fb9ad289a6f..efa62ace1b23 100644
> > > --- a/kernel/module/main.c
> > > +++ b/kernel/module/main.c
> > > @@ -3346,7 +3346,7 @@ static int load_module(struct load_info *info, const char __user *uargs,
> > >
> > >     module_allocated = true;
> > >
> > > -   audit_log_kern_module(mod->name);
> > > +   audit_log_kern_module(info->name);
> > >
> > >     /* Reserve our place in the list. */
> > >     err = add_unformed_module(mod);
> > > @@ -3506,8 +3506,10 @@ static int load_module(struct load_info *info, const char __user *uargs,
> > >      * failures once the proper module was allocated and
> > >      * before that.
> > >      */
> > > -   if (!module_allocated)
> > > +   if (!module_allocated) {
> > > +           audit_log_kern_module(info->name ? info->name : "(unavailable)");
> >
> > In keeping with audit tradition, wouldn't we want this to be "?" instead
> > of "(unavailable)"?

Any comment on the above?  This is more important than the non-public link ...

> > >             mod_stat_bump_becoming(info, flags);
> > > +   }
> > >     free_copy(info, flags);
> > >     return err;
> > >  }
> > > --
> > > 2.43.5

-- 
paul-moore.com