Re: [PATCH v2] audit: log module name on delete_module

+++ Paul Moore [13/03/17 10:16 -0400]: > > On Sat, Mar 11, 2017 at 9:24 PM, Richard Guy Briggs <rgb(a)redhat.com&gt; > wrote: >> >> When a sysadmin wishes to monitor module unloading with a syscall rule >> such as: >> -a always,exit -F arch=x86_64 -S delete_module -F key=mod-unload >> the SYSCALL record doesn't tell us what module was requested for >> unloading. >> >> Use the new KERN_MODULE auxiliary record to record it. >> The SYSCALL record result code will list the return code. >> >> See: https://github.com/linux-audit/audit-kernel/issues/37 >> https://github.com/linux-audit/audit-kernel/issues/7 >> >> https://github.com/linux-audit/audit-kernel/wiki/RFE-Module-Load-Record-F... >> >> Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com&gt; >> --- >> kernel/module.c | 2 ++ >> 1 files changed, 2 insertions(+), 0 deletions(-) > > > Jessica? If there are no objections to this patch on your side I'll > merge this into the audit/next tree. Looks good to me: Acked-by: Jessica Yu <jeyu(a)redhat.com&gt;