audit: log module name on init_module
authorRichard Guy Briggs <rgb@redhat.com>
Sat, 4 Feb 2017 18:10:38 +0000 (13:10 -0500)
committerPaul Moore <paul@paul-moore.com>
Mon, 13 Feb 2017 21:17:13 +0000 (16:17 -0500)
commitca86cad7380e373fa17bc0ee8aff121380323e69
tree68407211f533b1e8c30ce3ffc60206347d3811af
parent62bc306e2083436675e33b5bdeb6a77907d35971
audit: log module name on init_module

This adds a new auxiliary record MODULE_INIT to the SYSCALL event.

We get finit_module for free since it made most sense to hook this in to
load_module().

https://github.com/linux-audit/audit-kernel/issues/7
https://github.com/linux-audit/audit-kernel/wiki/RFE-Module-Load-Record-Format

Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
Acked-by: Jessica Yu <jeyu@redhat.com>
[PM: corrected links in the commit description]
Signed-off-by: Paul Moore <paul@paul-moore.com>
include/linux/audit.h
include/uapi/linux/audit.h
kernel/audit.h
kernel/auditsc.c
kernel/module.c