audit: log module name on init_module

Browse source

This adds a new auxiliary record MODULE_INIT to the SYSCALL event.

We get finit_module for free since it made most sense to hook this in to
load_module().

https://github.com/linux-audit/audit-kernel/issues/7
https://github.com/linux-audit/audit-kernel/wiki/RFE-Module-Load-Record-Format

Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
Acked-by: Jessica Yu <jeyu@redhat.com>
[PM: corrected links in the commit description]
Signed-off-by: Paul Moore <paul@paul-moore.com>

...

This commit is contained in:

Richard Guy Briggs 2017-02-04 13:10:38 -05:00 • committed by Paul Moore

parent 62bc306e20

commit ca86cad738

5 changed files with 34 additions and 1 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

12

include/linux/audit.h

View file

1

include/uapi/linux/audit.h

View file

3

kernel/audit.h

View file

14

kernel/auditsc.c

View file

5

kernel/module.c

View file