diff options
| author | Eric Paris <eparis@redhat.com> | 2009-11-03 16:35:32 +1100 |
|---|---|---|
| committer | James Morris <jmorris@namei.org> | 2009-11-10 09:33:46 +1100 |
| commit | dd8dbf2e6880e30c00b18600c962d0cb5a03c555 (patch) | |
| tree | 24835aaf40cec5ceb2aeecccde9240ee173f70f1 /security/lsm_audit.c | |
| parent | 6e65f92ff0d6f18580737321718d09035085a3fb (diff) | |
| download | lwn-dd8dbf2e6880e30c00b18600c962d0cb5a03c555.tar.gz lwn-dd8dbf2e6880e30c00b18600c962d0cb5a03c555.zip | |
security: report the module name to security_module_request
For SELinux to do better filtering in userspace we send the name of the
module along with the AVC denial when a program is denied module_request.
Example output:
type=SYSCALL msg=audit(11/03/2009 10:59:43.510:9) : arch=x86_64 syscall=write success=yes exit=2 a0=3 a1=7fc28c0d56c0 a2=2 a3=7fffca0d7440 items=0 ppid=1727 pid=1729 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=rpc.nfsd exe=/usr/sbin/rpc.nfsd subj=system_u:system_r:nfsd_t:s0 key=(null)
type=AVC msg=audit(11/03/2009 10:59:43.510:9) : avc: denied { module_request } for pid=1729 comm=rpc.nfsd kmod="net-pf-10" scontext=system_u:system_r:nfsd_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=system
Signed-off-by: Eric Paris <eparis@redhat.com>
Signed-off-by: James Morris <jmorris@namei.org>
Diffstat (limited to 'security/lsm_audit.c')
| -rw-r--r-- | security/lsm_audit.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/security/lsm_audit.c b/security/lsm_audit.c index 3bb90b6f1dd3..51bd0fd9c9f0 100644 --- a/security/lsm_audit.c +++ b/security/lsm_audit.c @@ -354,6 +354,10 @@ static void dump_common_audit_data(struct audit_buffer *ab, } break; #endif + case LSM_AUDIT_DATA_KMOD: + audit_log_format(ab, " kmod="); + audit_log_untrustedstring(ab, a->u.kmod_name); + break; } /* switch (a->type) */ } |