include/linux/audit.h | 9 ++++----- kernel/audit.h | 2 +- kernel/auditsc.c | 2 +- kernel/module/main.c | 6 ++++-- 4 files changed, 10 insertions(+), 9 deletions(-)
The move of the module sanity check to earlier skipped the audit logging
call in the case of failure and to a place where the previously used
context is unavailable.
Add an audit logging call for the module loading failure case and get
the module name when possible.
Link: https://issues.redhat.com/browse/RHEL-52839
Fixes: 02da2cbab452 ("module: move check_modinfo() early to early_mod_check()")
Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
---
Changelog:
v2
- use info->name for both audit_log_kern_module() calls and add const
---
include/linux/audit.h | 9 ++++-----
kernel/audit.h | 2 +-
kernel/auditsc.c | 2 +-
kernel/module/main.c | 6 ++++--
4 files changed, 10 insertions(+), 9 deletions(-)
diff --git a/include/linux/audit.h b/include/linux/audit.h
index 0050ef288ab3..a394614ccd0b 100644
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -417,7 +417,7 @@ extern int __audit_log_bprm_fcaps(struct linux_binprm *bprm,
extern void __audit_log_capset(const struct cred *new, const struct cred *old);
extern void __audit_mmap_fd(int fd, int flags);
extern void __audit_openat2_how(struct open_how *how);
-extern void __audit_log_kern_module(char *name);
+extern void __audit_log_kern_module(const char *name);
extern void __audit_fanotify(u32 response, struct fanotify_response_info_audit_rule *friar);
extern void __audit_tk_injoffset(struct timespec64 offset);
extern void __audit_ntp_log(const struct audit_ntp_data *ad);
@@ -519,7 +519,7 @@ static inline void audit_openat2_how(struct open_how *how)
__audit_openat2_how(how);
}
-static inline void audit_log_kern_module(char *name)
+static inline void audit_log_kern_module(const char *name)
{
if (!audit_dummy_context())
__audit_log_kern_module(name);
@@ -677,9 +677,8 @@ static inline void audit_mmap_fd(int fd, int flags)
static inline void audit_openat2_how(struct open_how *how)
{ }
-static inline void audit_log_kern_module(char *name)
-{
-}
+static inline void audit_log_kern_module(const char *name)
+{ }
static inline void audit_fanotify(u32 response, struct fanotify_response_info_audit_rule *friar)
{ }
diff --git a/kernel/audit.h b/kernel/audit.h
index 0211cb307d30..2a24d01c5fb0 100644
--- a/kernel/audit.h
+++ b/kernel/audit.h
@@ -200,7 +200,7 @@ struct audit_context {
int argc;
} execve;
struct {
- char *name;
+ const char *name;
} module;
struct {
struct audit_ntp_data ntp_data;
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 9c853cde9abe..7bc0462e86f3 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -2866,7 +2866,7 @@ void __audit_openat2_how(struct open_how *how)
context->type = AUDIT_OPENAT2;
}
-void __audit_log_kern_module(char *name)
+void __audit_log_kern_module(const char *name)
{
struct audit_context *context = audit_context();
diff --git a/kernel/module/main.c b/kernel/module/main.c
index 1fb9ad289a6f..efa62ace1b23 100644
--- a/kernel/module/main.c
+++ b/kernel/module/main.c
@@ -3346,7 +3346,7 @@ static int load_module(struct load_info *info, const char __user *uargs,
module_allocated = true;
- audit_log_kern_module(mod->name);
+ audit_log_kern_module(info->name);
/* Reserve our place in the list. */
err = add_unformed_module(mod);
@@ -3506,8 +3506,10 @@ static int load_module(struct load_info *info, const char __user *uargs,
* failures once the proper module was allocated and
* before that.
*/
- if (!module_allocated)
+ if (!module_allocated) {
+ audit_log_kern_module(info->name ? info->name : "(unavailable)");
mod_stat_bump_becoming(info, flags);
+ }
free_copy(info, flags);
return err;
}
--
2.43.5On Mar 17, 2025 Richard Guy Briggs <rgb@redhat.com> wrote:
>
> The move of the module sanity check to earlier skipped the audit logging
> call in the case of failure and to a place where the previously used
> context is unavailable.
>
> Add an audit logging call for the module loading failure case and get
> the module name when possible.
>
> Link: https://issues.redhat.com/browse/RHEL-52839
> Fixes: 02da2cbab452 ("module: move check_modinfo() early to early_mod_check()")
> Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
> ---
> Changelog:
> v2
> - use info->name for both audit_log_kern_module() calls and add const
> ---
> include/linux/audit.h | 9 ++++-----
> kernel/audit.h | 2 +-
> kernel/auditsc.c | 2 +-
> kernel/module/main.c | 6 ++++--
> 4 files changed, 10 insertions(+), 9 deletions(-)
Agree with Petr's previous comment about the URL in the commit
description, if it isn't publicly accessible please don't include it in
the commit description; I'm going to remove it.
> diff --git a/kernel/module/main.c b/kernel/module/main.c
> index 1fb9ad289a6f..efa62ace1b23 100644
> --- a/kernel/module/main.c
> +++ b/kernel/module/main.c
> @@ -3346,7 +3346,7 @@ static int load_module(struct load_info *info, const char __user *uargs,
>
> module_allocated = true;
>
> - audit_log_kern_module(mod->name);
> + audit_log_kern_module(info->name);
>
> /* Reserve our place in the list. */
> err = add_unformed_module(mod);
> @@ -3506,8 +3506,10 @@ static int load_module(struct load_info *info, const char __user *uargs,
> * failures once the proper module was allocated and
> * before that.
> */
> - if (!module_allocated)
> + if (!module_allocated) {
> + audit_log_kern_module(info->name ? info->name : "(unavailable)");
In keeping with audit tradition, wouldn't we want this to be "?" instead
of "(unavailable)"?
> mod_stat_bump_becoming(info, flags);
> + }
> free_copy(info, flags);
> return err;
> }
> --
> 2.43.5
--
paul-moore.com
On 2025-04-11 14:23, Paul Moore wrote:
> On Mar 17, 2025 Richard Guy Briggs <rgb@redhat.com> wrote:
> >
> > The move of the module sanity check to earlier skipped the audit logging
> > call in the case of failure and to a place where the previously used
> > context is unavailable.
> >
> > Add an audit logging call for the module loading failure case and get
> > the module name when possible.
> >
> > Link: https://issues.redhat.com/browse/RHEL-52839
> > Fixes: 02da2cbab452 ("module: move check_modinfo() early to early_mod_check()")
> > Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
> > ---
> > Changelog:
> > v2
> > - use info->name for both audit_log_kern_module() calls and add const
> > ---
> > include/linux/audit.h | 9 ++++-----
> > kernel/audit.h | 2 +-
> > kernel/auditsc.c | 2 +-
> > kernel/module/main.c | 6 ++++--
> > 4 files changed, 10 insertions(+), 9 deletions(-)
>
> Agree with Petr's previous comment about the URL in the commit
> description, if it isn't publicly accessible please don't include it in
> the commit description; I'm going to remove it.
Sorry, I thought I had checked it more than once to make sure it was
visible. It should be now. Please re-add the link.
> > diff --git a/kernel/module/main.c b/kernel/module/main.c
> > index 1fb9ad289a6f..efa62ace1b23 100644
> > --- a/kernel/module/main.c
> > +++ b/kernel/module/main.c
> > @@ -3346,7 +3346,7 @@ static int load_module(struct load_info *info, const char __user *uargs,
> >
> > module_allocated = true;
> >
> > - audit_log_kern_module(mod->name);
> > + audit_log_kern_module(info->name);
> >
> > /* Reserve our place in the list. */
> > err = add_unformed_module(mod);
> > @@ -3506,8 +3506,10 @@ static int load_module(struct load_info *info, const char __user *uargs,
> > * failures once the proper module was allocated and
> > * before that.
> > */
> > - if (!module_allocated)
> > + if (!module_allocated) {
> > + audit_log_kern_module(info->name ? info->name : "(unavailable)");
>
> In keeping with audit tradition, wouldn't we want this to be "?" instead
> of "(unavailable)"?
>
> > mod_stat_bump_becoming(info, flags);
> > + }
> > free_copy(info, flags);
> > return err;
> > }
> > --
> > 2.43.5
>
> --
> paul-moore.com
> _______________________________________________
> Linux-audit mailing list -- linux-audit@lists.linux-audit.osci.io
> To unsubscribe send an email to linux-audit-leave@lists.linux-audit.osci.io
- RGB
--
Richard Guy Briggs <rgb@redhat.com>
Sr. S/W Engineer, Kernel Security, Base Operating Systems
Remote, Ottawa, Red Hat Canada
Upstream IRC: SunRaycer
Voice: +1.613.860 2354 SMS: +1.613.518.6570
On Tue, Apr 22, 2025 at 11:37 AM Richard Guy Briggs <rgb@redhat.com> wrote:
> On 2025-04-11 14:23, Paul Moore wrote:
> > On Mar 17, 2025 Richard Guy Briggs <rgb@redhat.com> wrote:
...
> > > diff --git a/kernel/module/main.c b/kernel/module/main.c
> > > index 1fb9ad289a6f..efa62ace1b23 100644
> > > --- a/kernel/module/main.c
> > > +++ b/kernel/module/main.c
> > > @@ -3346,7 +3346,7 @@ static int load_module(struct load_info *info, const char __user *uargs,
> > >
> > > module_allocated = true;
> > >
> > > - audit_log_kern_module(mod->name);
> > > + audit_log_kern_module(info->name);
> > >
> > > /* Reserve our place in the list. */
> > > err = add_unformed_module(mod);
> > > @@ -3506,8 +3506,10 @@ static int load_module(struct load_info *info, const char __user *uargs,
> > > * failures once the proper module was allocated and
> > > * before that.
> > > */
> > > - if (!module_allocated)
> > > + if (!module_allocated) {
> > > + audit_log_kern_module(info->name ? info->name : "(unavailable)");
> >
> > In keeping with audit tradition, wouldn't we want this to be "?" instead
> > of "(unavailable)"?
Any comment on the above? This is more important than the non-public link ...
> > > mod_stat_bump_becoming(info, flags);
> > > + }
> > > free_copy(info, flags);
> > > return err;
> > > }
> > > --
> > > 2.43.5
--
paul-moore.com
On 3/17/25 20:57, Richard Guy Briggs wrote:
> The move of the module sanity check to earlier skipped the audit logging
> call in the case of failure and to a place where the previously used
> context is unavailable.
>
> Add an audit logging call for the module loading failure case and get
> the module name when possible.
>
> Link: https://issues.redhat.com/browse/RHEL-52839
> Fixes: 02da2cbab452 ("module: move check_modinfo() early to early_mod_check()")
> Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
The change looks reasonable to me from the modules perspective.
Nit: Viewing the linked address requires a login, so I'm not sure it's
appropriate for the commit message.
[...]
> diff --git a/kernel/module/main.c b/kernel/module/main.c
> index 1fb9ad289a6f..efa62ace1b23 100644
> --- a/kernel/module/main.c
> +++ b/kernel/module/main.c
> @@ -3346,7 +3346,7 @@ static int load_module(struct load_info *info, const char __user *uargs,
>
> module_allocated = true;
>
> - audit_log_kern_module(mod->name);
> + audit_log_kern_module(info->name);
>
> /* Reserve our place in the list. */
> err = add_unformed_module(mod);
> @@ -3506,8 +3506,10 @@ static int load_module(struct load_info *info, const char __user *uargs,
> * failures once the proper module was allocated and
> * before that.
> */
> - if (!module_allocated)
> + if (!module_allocated) {
> + audit_log_kern_module(info->name ? info->name : "(unavailable)");
> mod_stat_bump_becoming(info, flags);
> + }
> free_copy(info, flags);
> return err;
> }
Nit:
audit_log_kern_module(info->name ? info->name : "(unavailable)");
->
audit_log_kern_module(info->name ?: "(unavailable)");
--
Thanks,
Petr
© 2016 - 2025 Red Hat, Inc.