| commit | f6276ac95bde4312251535904af32b1de9d54949 | [log] [tgz] |
|---|---|---|
| author | Richard Guy Briggs <rgb@redhat.com> | Tue May 02 10:16:04 2017 -0400 |
| committer | Paul Moore <paul@paul-moore.com> | Tue May 02 10:16:04 2017 -0400 |
| tree | 94826d7413f2bf9265ea6305598ef4cd8e19a1f8 | |
| parent | 9aab4f4ea7a4ca80ec3e0269ce2eb71a24f6fef9 [diff] |
audit: log module name on delete_module When a sysadmin wishes to monitor module unloading with a syscall rule such as: -a always,exit -F arch=x86_64 -S delete_module -F key=mod-unload the SYSCALL record doesn't tell us what module was requested for unloading. Use the new KERN_MODULE auxiliary record to record it. The SYSCALL record result code will list the return code. See: https://github.com/linux-audit/audit-kernel/issues/37 https://github.com/linux-audit/audit-kernel/issues/7 https://github.com/linux-audit/audit-kernel/wiki/RFE-Module-Load-Record-Format Signed-off-by: Richard Guy Briggs <rgb@redhat.com> Acked-by: Jessica Yu <jeyu@redhat.com> Signed-off-by: Paul Moore <paul@paul-moore.com>