diff options
| author | Richard Guy Briggs <rgb@redhat.com> | 2017-02-04 13:10:38 -0500 |
|---|---|---|
| committer | Paul Moore <paul@paul-moore.com> | 2017-02-13 16:17:13 -0500 |
| commit | ca86cad7380e373fa17bc0ee8aff121380323e69 (patch) | |
| tree | 68407211f533b1e8c30ce3ffc60206347d3811af /kernel/module.c | |
| parent | 62bc306e2083436675e33b5bdeb6a77907d35971 (diff) | |
| download | linux-ca86cad7380e373fa17bc0ee8aff121380323e69.tar.gz linux-ca86cad7380e373fa17bc0ee8aff121380323e69.tar.bz2 linux-ca86cad7380e373fa17bc0ee8aff121380323e69.zip | |
audit: log module name on init_module
This adds a new auxiliary record MODULE_INIT to the SYSCALL event.
We get finit_module for free since it made most sense to hook this in to
load_module().
https://github.com/linux-audit/audit-kernel/issues/7
https://github.com/linux-audit/audit-kernel/wiki/RFE-Module-Load-Record-Format
Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
Acked-by: Jessica Yu <jeyu@redhat.com>
[PM: corrected links in the commit description]
Signed-off-by: Paul Moore <paul@paul-moore.com>
Diffstat (limited to 'kernel/module.c')
| -rw-r--r-- | kernel/module.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/kernel/module.c b/kernel/module.c index 529efae9f481..5432dbedf8cf 100644 --- a/kernel/module.c +++ b/kernel/module.c @@ -61,6 +61,7 @@ #include <linux/pfn.h> #include <linux/bsearch.h> #include <linux/dynamic_debug.h> +#include <linux/audit.h> #include <uapi/linux/module.h> #include "module-internal.h" @@ -3593,6 +3594,8 @@ static int load_module(struct load_info *info, const char __user *uargs, goto free_copy; } + audit_log_kern_module(mod->name); + /* Reserve our place in the list. */ err = add_unformed_module(mod); if (err) @@ -3681,7 +3684,7 @@ static int load_module(struct load_info *info, const char __user *uargs, mod->name, after_dashes); } - /* Link in to syfs. */ + /* Link in to sysfs. */ err = mod_sysfs_setup(mod, info, mod->kp, mod->num_kp); if (err < 0) goto coming_cleanup; |