Re: Hundreds of null PATH records for *init_module syscall audit logs
On 2017-03-07 10:41, Steven Rostedt wrote:
On Mon, 6 Mar 2017 22:39:54 -0500
Richard Guy Briggs <rgb(a)redhat.com> wrote:
> >From the output I've seen, it doesn't look particularly useful, but it
> was useful to finally see the source of those huge numbers of PATH
> records. Here's an fpaste:
>
https://paste.fedoraproject.org/paste/UpZoYuokojR0es1ayNdx5l5M1UNdIGYhyRL...
Those are the files for the module's trace events that are created.
I'm still confused about what the issue is.
The issue is the audit subsystem being overwhelmed by potentially
useless information.
The initial report was "there's a bunch of null PATH records, please
make them go away", which was anywhere from 500 to 6000 records.
Once I found out what they generally were and a way to enumerate the
contents, we're reviewing that assessment to see if they really should
be tossed, or listed out in full.
-- Steve
- RGB
--
Richard Guy Briggs <rgb(a)redhat.com>
Kernel Security Engineering, Base Operating Systems, Red Hat
Remote, Ottawa, Canada
Voice: +1.647.777.2635, Internal: (81) 32635