audit: log module name on init_module

This adds a new auxiliary record MODULE_INIT to the SYSCALL event. We get finit_module for free since it made most sense to hook this in to load_module(). https://github.com/linux-audit/audit-kernel/issues/7 https://github.com/linux-audit/audit-kernel/wiki/RFE-Module-Load-Record-Format

Richard Guy Briggs committed 9 years ago

Commit ca86cad1 parent 62bc3065 files · +34 −1Browse files

Showing the changes to include/uapi/linux (1 of 5 files). Show all

Unified · Split

include/uapi/linux/audit.h+1−0

@@ -111,6 +111,7 @@ · 110 unmodified lines
111	#define AUDIT_PROCTITLE 1327 /* Proctitle emit event */	111	#define AUDIT_PROCTITLE 1327 /* Proctitle emit event */
112	#define AUDIT_FEATURE_CHANGE 1328 /* audit log listing feature changes */	112	#define AUDIT_FEATURE_CHANGE 1328 /* audit log listing feature changes */
113	#define AUDIT_REPLACE 1329 /* Replace auditd if this packet unanswerd */	113	#define AUDIT_REPLACE 1329 /* Replace auditd if this packet unanswerd */
		114	#define AUDIT_KERN_MODULE 1330 /* Kernel Module events */
114		115
115	#define AUDIT_AVC 1400 /* SE Linux avc denial or grant */	116	#define AUDIT_AVC 1400 /* SE Linux avc denial or grant */
116	#define AUDIT_SELINUX_ERR 1401 /* Internal SE Linux Errors */	117	#define AUDIT_SELINUX_ERR 1401 /* Internal SE Linux Errors */