Commit ca86cad7 authored by Richard Guy Briggs's avatar Richard Guy Briggs Committed by Paul Moore
Browse files

audit: log module name on init_module 

This adds a new auxiliary record MODULE_INIT to the SYSCALL event.

We get finit_module for free since it made most sense to hook this in to
load_module().

https://github.com/linux-audit/audit-kernel/issues/7
https://github.com/linux-audit/audit-kernel/wiki/RFE-Module-Load-Record-Format



Signed-off-by: default avatarRichard Guy Briggs <rgb@redhat.com>
Acked-by: default avatarJessica Yu <jeyu@redhat.com>
[PM: corrected links in the commit description]
Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
parent 62bc306e

include/linux/audit.h

+12 −0
Original line number Diff line number Diff line
@@ -360,6 +360,7 @@ extern int __audit_log_bprm_fcaps(struct linux_binprm *bprm, 
				  const struct cred *old);

extern void __audit_log_capset(const struct cred *new, const struct cred *old);

extern void __audit_mmap_fd(int fd, int flags);

extern void __audit_log_kern_module(char *name);



static inline void audit_ipc_obj(struct kern_ipc_perm *ipcp)

{
@@ -450,6 +451,12 @@ static inline void audit_mmap_fd(int fd, int flags) 
		__audit_mmap_fd(fd, flags);

}



static inline void audit_log_kern_module(char *name)

{

	if (!audit_dummy_context())

		__audit_log_kern_module(name);

}



extern int audit_n_rules;

extern int audit_signals;

#else /* CONFIG_AUDITSYSCALL */
@@ -561,6 +568,11 @@ static inline void audit_log_capset(const struct cred *new, 
{ }

static inline void audit_mmap_fd(int fd, int flags)

{ }



static inline void audit_log_kern_module(char *name)

{

}



static inline void audit_ptrace(struct task_struct *t)

{ }

#define audit_n_rules 0

include/uapi/linux/audit.h

+1 −0
Original line number Diff line number Diff line
@@ -111,6 +111,7 @@ 
#define AUDIT_PROCTITLE		1327	/* Proctitle emit event */

#define AUDIT_FEATURE_CHANGE	1328	/* audit log listing feature changes */

#define AUDIT_REPLACE		1329	/* Replace auditd if this packet unanswerd */

#define AUDIT_KERN_MODULE	1330	/* Kernel Module events */



#define AUDIT_AVC		1400	/* SE Linux avc denial or grant */

#define AUDIT_SELINUX_ERR	1401	/* Internal SE Linux Errors */

kernel/audit.h

+3 −0
Original line number Diff line number Diff line
@@ -199,6 +199,9 @@ struct audit_context { 
		struct {

			int			argc;

		} execve;

		struct {

			char			*name;

		} module;

	};

	int fds[2];

	struct audit_proctitle proctitle;

kernel/auditsc.c

+14 −0
Original line number Diff line number Diff line
@@ -1268,6 +1268,11 @@ static void show_special(struct audit_context *context, int *call_panic) 
	case AUDIT_EXECVE: {

		audit_log_execve_info(context, &ab);

		break; }

	case AUDIT_KERN_MODULE:

		audit_log_format(ab, "name=");

		audit_log_untrustedstring(ab, context->module.name);

		kfree(context->module.name);

		break;

	}

	audit_log_end(ab);

}
@@ -2368,6 +2373,15 @@ void __audit_mmap_fd(int fd, int flags) 
	context->type = AUDIT_MMAP;

}



void __audit_log_kern_module(char *name)

{

	struct audit_context *context = current->audit_context;



	context->module.name = kmalloc(strlen(name) + 1, GFP_KERNEL);

	strcpy(context->module.name, name);

	context->type = AUDIT_KERN_MODULE;

}



static void audit_log_task(struct audit_buffer *ab)

{

	kuid_t auid, uid;

kernel/module.c

+4 −1
Original line number Diff line number Diff line
@@ -61,6 +61,7 @@ 
#include <linux/pfn.h>

#include <linux/bsearch.h>

#include <linux/dynamic_debug.h>

#include <linux/audit.h>

#include <uapi/linux/module.h>

#include "module-internal.h"
@@ -3593,6 +3594,8 @@ static int load_module(struct load_info *info, const char __user *uargs, 
		goto free_copy;

	}



	audit_log_kern_module(mod->name);



	/* Reserve our place in the list. */

	err = add_unformed_module(mod);

	if (err)
@@ -3681,7 +3684,7 @@ static int load_module(struct load_info *info, const char __user *uargs, 
		       mod->name, after_dashes);

	}



	/* Link in to syfs. */

	/* Link in to sysfs. */

	err = mod_sysfs_setup(mod, info, mod->kp, mod->num_kp);

	if (err < 0)

		goto coming_cleanup;

CRA Git | Maintained and supported by SUSTech CRA and CCSE