Messages in this thread | | | From | Steve Grubb <> | Subject | Re: Hundreds of null PATH records for *init_module syscall audit logs | Date | Thu, 09 Mar 2017 08:24:05 -0500 |
| |
On Friday, March 3, 2017 4:14:54 PM EST Richard Guy Briggs wrote: > > > > 1 - In __audit_inode_child, return immedialy upon detecting TRACEFS > > > > and > > > > > > > > DEBUGFS (and potentially other filesystems identified, via s_magic). > > > > XFS creates them too. Who knows what else. > > Why would this happen? I would assume it is a mounted filesystem. Do > you have a sample of the extra records?
I can't find them right away. But I've seen them.
> This brings me back to the original reaction I had to your suggestion > which is: Are you certain there is never a circumstance where *_module > syscalls never involve a file? Say, the module itself on loading pulls > in other files from the mounted filesystem?
We don't care about this. Audit events have to tell a story. They must have a subject, action, and object. In this case its "somebody loaded a kernel module X". Where X is the module name. Paths are irrelevant to the story and just make it hard to understand the event.
-Steve
| |