Messages in this thread | | | From | Steve Grubb <> | Subject | Re: Hundreds of null PATH records for *init_module syscall audit logs | Date | Thu, 09 Mar 2017 08:25:30 -0500 |
| |
On Monday, March 6, 2017 4:49:21 PM EST Richard Guy Briggs wrote: > > Blocking PATH record on creation based on syscall *really* seems like > > a bad/dangerous idea. If we want to block all these tracefs/debugfs > > records, let's just block the fs. Although as of right now I'm not a > > fan of blocking anything. > > I agree. What makes me leery of this approach is if a kernel module in > turn accesses directly other files, or bypasses the load_module call to > load another module from a file and avoids logging.
In this case, we want a second event with that module name. We do not want any PATH records.
-Steve
| |