lkml.org 
[lkml]   [2017]   [Mar]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: Hundreds of null PATH records for *init_module syscall audit logs
Date
On Monday, March 6, 2017 4:49:21 PM EST Richard Guy Briggs wrote:
> > Blocking PATH record on creation based on syscall *really* seems like
> > a bad/dangerous idea. If we want to block all these tracefs/debugfs
> > records, let's just block the fs. Although as of right now I'm not a
> > fan of blocking anything.
>
> I agree. What makes me leery of this approach is if a kernel module in
> turn accesses directly other files, or bypasses the load_module call to
> load another module from a file and avoids logging.

In this case, we want a second event with that module name. We do not want any
PATH records.

-Steve

\
 
 \ /
  Last update: 2017-03-09 14:26    [W:0.163 / U:0.504 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site