security: report the module name to security_module_request
authorEric Paris <eparis@redhat.com>
Tue, 3 Nov 2009 05:35:32 +0000 (16:35 +1100)
committerJames Morris <jmorris@namei.org>
Mon, 9 Nov 2009 22:33:46 +0000 (09:33 +1100)
commitdd8dbf2e6880e30c00b18600c962d0cb5a03c555
tree24835aaf40cec5ceb2aeecccde9240ee173f70f1
parent6e65f92ff0d6f18580737321718d09035085a3fb
security: report the module name to security_module_request

For SELinux to do better filtering in userspace we send the name of the
module along with the AVC denial when a program is denied module_request.

Example output:

type=SYSCALL msg=audit(11/03/2009 10:59:43.510:9) : arch=x86_64 syscall=write success=yes exit=2 a0=3 a1=7fc28c0d56c0 a2=2 a3=7fffca0d7440 items=0 ppid=1727 pid=1729 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=rpc.nfsd exe=/usr/sbin/rpc.nfsd subj=system_u:system_r:nfsd_t:s0 key=(null)
type=AVC msg=audit(11/03/2009 10:59:43.510:9) : avc:  denied  { module_request } for  pid=1729 comm=rpc.nfsd kmod="net-pf-10" scontext=system_u:system_r:nfsd_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=system

Signed-off-by: Eric Paris <eparis@redhat.com>
Signed-off-by: James Morris <jmorris@namei.org>
include/linux/lsm_audit.h
include/linux/security.h
kernel/kmod.c
security/capability.c
security/lsm_audit.c
security/security.c
security/selinux/hooks.c