On Tue, Apr 22, 2025 at 11:37 AM Richard Guy Briggs <r...@redhat.com> wrote:
> On 2025-04-11 14:23, Paul Moore wrote:
> > On Mar 17, 2025 Richard Guy Briggs <r...@redhat.com> wrote:
...
> > > diff --git a/kernel/module/main.c b/kernel/module/main.c
> > > index 1fb9ad289a6f..efa62ace1b23 100644
> > > --- a/kernel/module/main.c
> > > +++ b/kernel/module/main.c
> > > @@ -3346,7 +3346,7 @@ static int load_module(struct load_info *info,
> > > const char __user *uargs,
> > >
> > > module_allocated = true;
> > >
> > > - audit_log_kern_module(mod->name);
> > > + audit_log_kern_module(info->name);
> > >
> > > /* Reserve our place in the list. */
> > > err = add_unformed_module(mod);
> > > @@ -3506,8 +3506,10 @@ static int load_module(struct load_info *info,
> > > const char __user *uargs,
> > > * failures once the proper module was allocated and
> > > * before that.
> > > */
> > > - if (!module_allocated)
> > > + if (!module_allocated) {
> > > + audit_log_kern_module(info->name ? info->name :
> > > "(unavailable)");
> >
> > In keeping with audit tradition, wouldn't we want this to be "?" instead
> > of "(unavailable)"?
Any comment on the above? This is more important than the non-public link ...
> > > mod_stat_bump_becoming(info, flags);
> > > + }
> > > free_copy(info, flags);
> > > return err;
> > > }
> > > --
> > > 2.43.5
--
paul-moore.com
_______________________________________________
Linux-audit mailing list -- linux-audit@lists.linux-audit.osci.io
To unsubscribe send an email to linux-audit-le...@lists.linux-audit.osci.io
