lkml.org 
[lkml]   [2017]   [Mar]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH ALT5] audit: ignore module syscalls on inode child
    Date
    Tracefs or debugfs were causing hundreds to thousands of null PATH
    records to be associated with the init_module and finit_module SYSCALL
    records on a few modules when the following rule was in place for
    startup:
    -a always,exit -F arch=x86_64 -S init_module -F key=mod-load

    In __audit_inode_child, return immedialy upon detecting module-related
    syscalls.

    See https://github.com/linux-audit/audit-kernel/issues/8
    Test case: https://github.com/linux-audit/audit-testsuite/issues/42

    Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
    ---
    kernel/auditsc.c | 6 ++++++
    1 files changed, 6 insertions(+), 0 deletions(-)

    diff --git a/kernel/auditsc.c b/kernel/auditsc.c
    index 4db32e8..d7fe943 100644
    --- a/kernel/auditsc.c
    +++ b/kernel/auditsc.c
    @@ -1868,6 +1868,12 @@ void __audit_inode_child(struct inode *parent,

    if (!context->in_syscall)
    return;
    + switch (context->major) {
    + case __NR_init_module:
    + case __NR_delete_module:
    + case __NR_finit_module:
    + return;
    + }

    if (inode)
    handle_one(inode);
    --
    1.7.1
    \
     
     \ /
      Last update: 2017-03-03 23:25    [W:3.122 / U:0.028 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site