[PATCH] audit: log module name on delete_module

[Paul Moore]

On Thu, Mar 9, 2017 at 9:49 AM, Miroslav Benes <mbenes at suse.cz> wrote:
> On Thu, 9 Mar 2017, Richard Guy Briggs wrote:
>
>> Record the module name of a delete_module call.
>>
>> See: https://github.com/linux-audit/audit-kernel/issues/37
>>
>> Signed-off-by: Richard Guy Briggs <rgb at redhat.com>
>
> Could you improve the changelog, please? I don't think that a link to
> a github issue can and should replace it. Proper description and reason of
> the change should be in git log.

Agreed.  While I think it is nice that Richard included the GitHub
issue tracker link, the commit message needs to stand on it's own
describing the change.  The GitHub issue is an optional piece of
information which links to the development history and extended
information not normally suitable for a commit message.

>> ---
>>  kernel/module.c |    2 ++
>>  1 files changed, 2 insertions(+), 0 deletions(-)
>>
>> diff --git a/kernel/module.c b/kernel/module.c
>> index 5432dbe..633f6da 100644
>> --- a/kernel/module.c
>> +++ b/kernel/module.c
>> @@ -943,6 +943,8 @@ SYSCALL_DEFINE2(delete_module, const char __user *, name_user,
>>               return -EFAULT;
>>       name[MODULE_NAME_LEN-1] = '\0';
>>
>> +     audit_log_kern_module(name);
>> +
>>       if (mutex_lock_interruptible(&module_mutex) != 0)
>>               return -EINTR;
>>
>> --
>> 1.7.1
>>
>
> --
> Linux-audit mailing list
> Linux-audit at redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit

-- 
paul moore
www.paul-moore.com