On Tuesday, April 22, 2025 12:30:01 PM Eastern Daylight Time Paul Moore
wrote:
> On Tue, Apr 22, 2025 at 11:37 AM Richard Guy Briggs <rgb@xxxxxxxxxx>
> wrote:
> > On 2025-04-11 14:23, Paul Moore wrote:
> >
> > > On Mar 17, 2025 Richard Guy Briggs <rgb@xxxxxxxxxx> wrote:
>
>
> ...
>
>
> > > > diff --git a/kernel/module/main.c b/kernel/module/main.c
> > > > index 1fb9ad289a6f..efa62ace1b23 100644
> > > > --- a/kernel/module/main.c
> > > > +++ b/kernel/module/main.c
> > > > @@ -3346,7 +3346,7 @@ static int load_module(struct load_info *info,
> > > > const char __user *uargs,
> > >
> > > >
> > > >
> > > > module_allocated = true;
> > > >
> > > >
> > > >
> > > > - audit_log_kern_module(mod->name);
> > > > + audit_log_kern_module(info->name);
> > > >
> > > >
> > > >
> > > > /* Reserve our place in the list. */
> > > > err = add_unformed_module(mod);
> > > >
> > > > @@ -3506,8 +3506,10 @@ static int load_module(struct load_info *info,
> > > > const char __user *uargs,
> > >
> > > > * failures once the proper module was allocated and
> > > > * before that.
> > > > */
> > > >
> > > > - if (!module_allocated)
> > > > + if (!module_allocated) {
> > > > + audit_log_kern_module(info->name ? info->name :
> > > > "(unavailable)");
> >
> > > In keeping with audit tradition, wouldn't we want this to be "?"
> > > instead of "(unavailable)"?
>
> Any comment on the above? This is more important than the non-public link
> ...
It would save some disk space and stay similar to all other events. I also
think it should be "?".
-Steve
> > > > mod_stat_bump_becoming(info, flags);
> > > >
> > > > + }
> > > >
> > > > free_copy(info, flags);
> > > > return err;
> > > >
> > > > }
> > > >
> > > > --
> > > > 2.43.5
>
>
> --
> paul-moore.com
> _______________________________________________
> Linux-audit mailing list -- linux-audit@xxxxxxxxxxxxxxxxxxxxxxxxx
> To unsubscribe send an email to linux-audit-leave@xxxxxxxxxxxxxxxxxxxxxxxxx
