Re: finit_module

[Steve Grubb <sgrubb@redhat.com>]

On Friday, April 04, 2014 05:37:25 PM Richard Guy Briggs wrote:
> > > In checking a system with newish kernel, 3.13.7, I noticed that
> > > sometimes 
> > > finit_module is producing PATH records. Why?
> >
> > Probably because modprobe is walking the
> >       /lib/modules/$(uname -r)/kernel/
> > tree looking for the module named.
> 
> Is modprobe forcing a depmod to run, populating:
>         /lib/modules/$(uname -r)/modules.*

No idea, because we don't know which module is being loaded. It seems like we 
might could use an auxiliary record to log some information about the module 
being inserted into the kernel. Like if it has an internal name, is it signed, 
did it taint the kernel, did the signature verify correctly?


> Does this happen at most once per boot?

There are several.


> > But...  why are all the pathnames null?
> 
> Did you try to track down what some of the dev/inode pathnames were?

No. I don't use debugfs...which is the only good clue I have.

> The number does seem high for this though, since they appear to all be
> CREATE records.
> 
> Do you have a test to provoke it?  A set of rules and a test command?

Just enable the stig.rule and reboot your system. It has:

-w /sbin/insmod -p x -k modules-add
-w /sbin/rmmod -p x -k modules-del
-w /sbin/modprobe -p x -k modules
-a always,exit -F arch=b32 -S init_module -S finit_module -k module-load
-a always,exit -F arch=b64 -S init_module -S finit_module -k module-load
-a always,exit -F arch=b32 -S delete_module -k module-unload
-a always,exit -F arch=b64 -S delete_module -k module-unload


-Steve