linux-kernel - Re: [PATCH v2] audit,module: restore audit logging in load failure case

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <2755922.lGaqSPkdTl@x2>
Date: Tue, 22 Apr 2025 16:44:41 -0400
From: Steve Grubb <sgrubb@...hat.com>
To: Richard Guy Briggs <rgb@...hat.com>, linux-audit@...ts.linux-audit.osci.io
Cc: Linux-Audit Mailing List <linux-audit@...ts.linux-audit.osci.io>,
 LKML <linux-kernel@...r.kernel.org>, linux-modules@...r.kernel.org,
 Linux Kernel Audit Mailing List <audit@...r.kernel.org>,
 Eric Paris <eparis@...isplace.org>, Paul Moore <paul@...l-moore.com>
Subject:
 Re: [PATCH v2] audit,module: restore audit logging in load failure case

On Tuesday, April 22, 2025 12:30:01 PM Eastern Daylight Time Paul Moore 
wrote:
> On Tue, Apr 22, 2025 at 11:37 AM Richard Guy Briggs <rgb@...hat.com>
> wrote:
> > On 2025-04-11 14:23, Paul Moore wrote:
> > 
> > > On Mar 17, 2025 Richard Guy Briggs <rgb@...hat.com> wrote:
> 
> 
> ...
> 
> 
> > > > diff --git a/kernel/module/main.c b/kernel/module/main.c
> > > > index 1fb9ad289a6f..efa62ace1b23 100644
> > > > --- a/kernel/module/main.c
> > > > +++ b/kernel/module/main.c
> > > > @@ -3346,7 +3346,7 @@ static int load_module(struct load_info *info,
> > > > const char __user *uargs,
> > >
> > > >
> > > >
> > > >     module_allocated = true;
> > > >
> > > >
> > > >
> > > > -   audit_log_kern_module(mod->name);
> > > > +   audit_log_kern_module(info->name);
> > > >
> > > >
> > > >
> > > >     /* Reserve our place in the list. */
> > > >     err = add_unformed_module(mod);
> > > > 
> > > > @@ -3506,8 +3506,10 @@ static int load_module(struct load_info *info,
> > > > const char __user *uargs,
> > > 
> > > >      * failures once the proper module was allocated and
> > > >      * before that.
> > > >      */
> > > > 
> > > > -   if (!module_allocated)
> > > > +   if (!module_allocated) {
> > > > +           audit_log_kern_module(info->name ? info->name :
> > > > "(unavailable)");
> >
> > > In keeping with audit tradition, wouldn't we want this to be "?"
> > > instead of "(unavailable)"?
> 
> Any comment on the above?  This is more important than the non-public link
> ...

It would save some disk space and stay similar to all other events. I also 
think it should be "?".

-Steve

> > > >             mod_stat_bump_becoming(info, flags);
> > > > 
> > > > +   }
> > > > 
> > > >     free_copy(info, flags);
> > > >     return err;
> > > >  
> > > >  }
> > > > 
> > > > --
> > > > 2.43.5
> 
> 
> -- 
> paul-moore.com
> _______________________________________________
> Linux-audit mailing list -- linux-audit@...ts.linux-audit.osci.io
> To unsubscribe send an email to linux-audit-leave@...ts.linux-audit.osci.io