Re: [PATCH v2] audit,module: restore audit logging in load failure case

[Steve Grubb <sgrubb@redhat.com>]

On Tuesday, April 22, 2025 12:30:01 PM Eastern Daylight Time Paul Moore 
wrote:
> On Tue, Apr 22, 2025 at 11:37 AM Richard Guy Briggs <rgb@redhat.com>
> wrote:
> > On 2025-04-11 14:23, Paul Moore wrote:
> > 
> > > On Mar 17, 2025 Richard Guy Briggs <rgb@redhat.com> wrote:
> 
> 
> ...
> 
> 
> > > > diff --git a/kernel/module/main.c b/kernel/module/main.c
> > > > index 1fb9ad289a6f..efa62ace1b23 100644
> > > > --- a/kernel/module/main.c
> > > > +++ b/kernel/module/main.c
> > > > @@ -3346,7 +3346,7 @@ static int load_module(struct load_info *info,
> > > > const char __user *uargs,
> > >
> > > >
> > > >
> > > >     module_allocated = true;
> > > >
> > > >
> > > >
> > > > -   audit_log_kern_module(mod->name);
> > > > +   audit_log_kern_module(info->name);
> > > >
> > > >
> > > >
> > > >     /* Reserve our place in the list. */
> > > >     err = add_unformed_module(mod);
> > > > 
> > > > @@ -3506,8 +3506,10 @@ static int load_module(struct load_info *info,
> > > > const char __user *uargs,
> > > 
> > > >      * failures once the proper module was allocated and
> > > >      * before that.
> > > >      */
> > > > 
> > > > -   if (!module_allocated)
> > > > +   if (!module_allocated) {
> > > > +           audit_log_kern_module(info->name ? info->name :
> > > > "(unavailable)");
> >
> > > In keeping with audit tradition, wouldn't we want this to be "?"
> > > instead of "(unavailable)"?
> 
> Any comment on the above?  This is more important than the non-public link
> ...

It would save some disk space and stay similar to all other events. I also 
think it should be "?".

-Steve

> > > >             mod_stat_bump_becoming(info, flags);
> > > > 
> > > > +   }
> > > > 
> > > >     free_copy(info, flags);
> > > >     return err;
> > > >  
> > > >  }
> > > > 
> > > > --
> > > > 2.43.5
> 
> 
> -- 
> paul-moore.com
> _______________________________________________
> Linux-audit mailing list -- linux-audit@lists.linux-audit.osci.io
> To unsubscribe send an email to linux-audit-leave@lists.linux-audit.osci.io