From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751875AbdCAD03 (ORCPT ); Tue, 28 Feb 2017 22:26:29 -0500 Received: from mx1.redhat.com ([209.132.183.28]:41794 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751393AbdCAD00 (ORCPT ); Tue, 28 Feb 2017 22:26:26 -0500 From: Richard Guy Briggs To: linux-kernel@vger.kernel.org, linux-audit@redhat.com Cc: Richard Guy Briggs , Steven Rostedt , Ingo Molnar , Greg Kroah-Hartman , Al Viro , Eric Paris , Paul Moore , Steve Grubb Subject: [PATCH ALT3] audit: hide PATH records of anonymous parents and their children Date: Tue, 28 Feb 2017 22:26:00 -0500 Message-Id: In-Reply-To: <20170301031549.GT18258@madcap2.tricolour.ca> References: <20170301031549.GT18258@madcap2.tricolour.ca> X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.39]); Wed, 01 Mar 2017 03:26:26 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Tracefs or debugfs were causing hundreds to thousands of null PATH records to be associated with the init_module and finit_module SYSCALL records on a few modules when the following rule was in place for startup: -a always,exit -F arch=x86_64 -S init_module -F key=mod-load This patch hides those records, but the SYSCALL record "items=" count will still reflect the number of hidden items. (This will fail the test below.) See https://github.com/linux-audit/audit-kernel/issues/8 Test case: https://github.com/linux-audit/audit-testsuite/issues/42 Signed-off-by: Richard Guy Briggs --- kernel/auditsc.c | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-) diff --git a/kernel/auditsc.c b/kernel/auditsc.c index 4db32e8..58ea64e 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -1914,6 +1914,7 @@ void __audit_inode_child(struct inode *parent, if (!n) return; audit_copy_inode(n, NULL, parent); + n->hidden = true; } if (!found_child) { @@ -1928,6 +1929,8 @@ void __audit_inode_child(struct inode *parent, found_child->name = found_parent->name; found_child->name_len = AUDIT_NAME_FULL; found_child->name->refcnt++; + } else { + found_child->hidden = true; } } -- 1.7.1