From: Steve Grubb <sgrubb@redhat.com>
To: Richard Guy Briggs <rgb@redhat.com>
Cc: Paul Moore <paul@paul-moore.com>, Jessica Yu <jeyu@redhat.com>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
LKML <linux-kernel@vger.kernel.org>,
Steven Rostedt <rostedt@goodmis.org>,
Linux-Audit Mailing List <linux-audit@redhat.com>,
Al Viro <viro@zeniv.linux.org.uk>, Ingo Molnar <mingo@redhat.com>
Subject: Re: Hundreds of null PATH records for *init_module syscall audit logs
Date: Thu, 09 Mar 2017 08:25:30 -0500 [thread overview]
Message-ID: <1506758.nmGZ90BLZd@x2> (raw)
In-Reply-To: <20170306214921.GR18258@madcap2.tricolour.ca>
On Monday, March 6, 2017 4:49:21 PM EST Richard Guy Briggs wrote:
> > Blocking PATH record on creation based on syscall *really* seems like
> > a bad/dangerous idea. If we want to block all these tracefs/debugfs
> > records, let's just block the fs. Although as of right now I'm not a
> > fan of blocking anything.
>
> I agree. What makes me leery of this approach is if a kernel module in
> turn accesses directly other files, or bypasses the load_module call to
> load another module from a file and avoids logging.
In this case, we want a second event with that module name. We do not want any
PATH records.
-Steve
next prev parent reply other threads:[~2017-03-09 13:25 UTC|newest]
Thread overview: 28+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-03-01 3:15 Hundreds of null PATH records for *init_module syscall audit logs Richard Guy Briggs
2017-03-01 3:24 ` [PATCH ALT1] audit: ignore tracefs and debugfs on inode child Richard Guy Briggs
2017-03-01 3:26 ` [PATCH ALT3] audit: hide PATH records of anonymous parents and their children Richard Guy Briggs
2017-03-01 3:29 ` [PATCH ALT2] audit: don't create PATH records for " Richard Guy Briggs
2017-03-01 3:29 ` [PATCH ALT4] audit: show fstype:pathname for entries with anonymous parents Richard Guy Briggs
2017-03-02 12:58 ` kbuild test robot
2017-03-01 3:37 ` Hundreds of null PATH records for *init_module syscall audit logs Richard Guy Briggs
2017-03-01 4:15 ` Steve Grubb
2017-03-03 21:14 ` Richard Guy Briggs
2017-03-03 22:24 ` [PATCH ALT5] audit: ignore module syscalls on inode child Richard Guy Briggs
2017-03-04 0:22 ` Hundreds of null PATH records for *init_module syscall audit logs Paul Moore
2017-03-06 21:49 ` Richard Guy Briggs
2017-03-06 22:30 ` Jessica Yu
2017-03-07 3:46 ` Richard Guy Briggs
2017-03-09 13:25 ` Steve Grubb [this message]
2017-03-09 13:24 ` Steve Grubb
2017-03-04 0:19 ` Paul Moore
2017-03-07 3:39 ` Richard Guy Briggs
2017-03-07 15:41 ` Steven Rostedt
2017-03-07 16:00 ` Richard Guy Briggs
2017-03-07 16:20 ` Steven Rostedt
2017-03-07 17:39 ` Richard Guy Briggs
2017-03-07 18:04 ` Steven Rostedt
2017-03-07 18:34 ` Richard Guy Briggs
2017-03-07 19:09 ` Steven Rostedt
2017-03-07 22:00 ` Richard Guy Briggs
2017-03-09 13:33 ` Steve Grubb
2017-03-07 15:37 ` Steven Rostedt
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1506758.nmGZ90BLZd@x2 \
--to=sgrubb@redhat.com \
--cc=gregkh@linuxfoundation.org \
--cc=jeyu@redhat.com \
--cc=linux-audit@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mingo@redhat.com \
--cc=paul@paul-moore.com \
--cc=rgb@redhat.com \
--cc=rostedt@goodmis.org \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox