From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: finit_module Date: Sat, 05 Apr 2014 07:57:13 -0400 Message-ID: <13325858.91S3hfEbTB@x2> References: <2949295.7qgFVbk0cj@x2> <20140404182940.GC24821@madcap2.tricolour.ca> <20140404213725.GC2171@madcap2.tricolour.ca> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <20140404213725.GC2171@madcap2.tricolour.ca> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Richard Guy Briggs Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Friday, April 04, 2014 05:37:25 PM Richard Guy Briggs wrote: > > > In checking a system with newish kernel, 3.13.7, I noticed that > > > sometimes > > > finit_module is producing PATH records. Why? > > > > Probably because modprobe is walking the > > /lib/modules/$(uname -r)/kernel/ > > tree looking for the module named. > > Is modprobe forcing a depmod to run, populating: > /lib/modules/$(uname -r)/modules.* No idea, because we don't know which module is being loaded. It seems like we might could use an auxiliary record to log some information about the module being inserted into the kernel. Like if it has an internal name, is it signed, did it taint the kernel, did the signature verify correctly? > Does this happen at most once per boot? There are several. > > But... why are all the pathnames null? > > Did you try to track down what some of the dev/inode pathnames were? No. I don't use debugfs...which is the only good clue I have. > The number does seem high for this though, since they appear to all be > CREATE records. > > Do you have a test to provoke it? A set of rules and a test command? Just enable the stig.rule and reboot your system. It has: -w /sbin/insmod -p x -k modules-add -w /sbin/rmmod -p x -k modules-del -w /sbin/modprobe -p x -k modules -a always,exit -F arch=b32 -S init_module -S finit_module -k module-load -a always,exit -F arch=b64 -S init_module -S finit_module -k module-load -a always,exit -F arch=b32 -S delete_module -k module-unload -a always,exit -F arch=b64 -S delete_module -k module-unload -Steve