lkml.org 
[lkml]   [2017]   [Mar]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: Hundreds of null PATH records for *init_module syscall audit logs
Date
On Friday, March 3, 2017 4:14:54 PM EST Richard Guy Briggs wrote:
> > > > 1 - In __audit_inode_child, return immedialy upon detecting TRACEFS
> > > > and
> > > >
> > > > DEBUGFS (and potentially other filesystems identified, via s_magic).
> >
> > XFS creates them too. Who knows what else.
>
> Why would this happen? I would assume it is a mounted filesystem. Do
> you have a sample of the extra records?

I can't find them right away. But I've seen them.

> This brings me back to the original reaction I had to your suggestion
> which is: Are you certain there is never a circumstance where *_module
> syscalls never involve a file? Say, the module itself on loading pulls
> in other files from the mounted filesystem?

We don't care about this. Audit events have to tell a story. They must have a
subject, action, and object. In this case its "somebody loaded a kernel module
X". Where X is the module name. Paths are irrelevant to the story and just
make it hard to understand the event.

-Steve

\
 
 \ /
  Last update: 2017-03-09 14:25    [W:0.113 / U:0.948 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site