Re: [PATCH v2] audit,module: restore audit logging in load failure case

On Tue, Apr 22, 2025 at 11:37 AM Richard Guy Briggs <rgb(a)redhat.com&gt; wrote: > On 2025-04-11 14:23, Paul Moore wrote: > > > On Mar 17, 2025 Richard Guy Briggs <rgb(a)redhat.com&gt; wrote: ... > > > diff --git a/kernel/module/main.c b/kernel/module/main.c > > > index 1fb9ad289a6f..efa62ace1b23 100644 > > > --- a/kernel/module/main.c > > > +++ b/kernel/module/main.c > > > @@ -3346,7 +3346,7 @@ static int load_module(struct load_info *info, > > > const char __user *uargs, > > > > > > > > > > > module_allocated = true; > > > > > > > > > > > > - audit_log_kern_module(mod->name); > > > + audit_log_kern_module(info->name); > > > > > > > > > > > > /* Reserve our place in the list. */ > > > err = add_unformed_module(mod); > > > > > > @@ -3506,8 +3506,10 @@ static int load_module(struct load_info *info, > > > const char __user *uargs, > > > > > * failures once the proper module was allocated and > > > * before that. > > > */ > > > > > > - if (!module_allocated) > > > + if (!module_allocated) { > > > + audit_log_kern_module(info->name ? info->name : > > > "(unavailable)"); > > > In keeping with audit tradition, wouldn't we want this to be "?" > > instead of "(unavailable)"? Any comment on the above? This is more important than the non-public link ...

> > > mod_stat_bump_becoming(info, flags); > > > > > > + } > > > > > > free_copy(info, flags); > > > return err; > > > > > > } > > > > > > -- > > > 2.43.5 -- paul-moore.com _______________________________________________ Linux-audit mailing list -- linux-audit(a)lists.linux-audit.osci.io To unsubscribe send an email to linux-audit-leave(a)lists.linux-audit.osci.io