lkml.org 
[lkml]   [2017]   [Mar]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: Hundreds of null PATH records for *init_module syscall audit logs
    On 2017-03-07 10:41, Steven Rostedt wrote:
    > On Mon, 6 Mar 2017 22:39:54 -0500
    > Richard Guy Briggs <rgb@redhat.com> wrote:
    >
    > > >From the output I've seen, it doesn't look particularly useful, but it
    > > was useful to finally see the source of those huge numbers of PATH
    > > records. Here's an fpaste:
    > > https://paste.fedoraproject.org/paste/UpZoYuokojR0es1ayNdx5l5M1UNdIGYhyRLivL9gydE=/
    >
    > Those are the files for the module's trace events that are created.
    >
    > I'm still confused about what the issue is.

    The issue is the audit subsystem being overwhelmed by potentially
    useless information.

    The initial report was "there's a bunch of null PATH records, please
    make them go away", which was anywhere from 500 to 6000 records.

    Once I found out what they generally were and a way to enumerate the
    contents, we're reviewing that assessment to see if they really should
    be tossed, or listed out in full.

    > -- Steve

    - RGB

    --
    Richard Guy Briggs <rgb@redhat.com>
    Kernel Security Engineering, Base Operating Systems, Red Hat
    Remote, Ottawa, Canada
    Voice: +1.647.777.2635, Internal: (81) 32635

    \
     
     \ /
      Last update: 2017-03-07 17:26    [W:4.869 / U:0.012 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site