-
Richard Guy Briggs authored
When a sysadmin wishes to monitor module unloading with a syscall rule such as: -a always,exit -F arch=x86_64 -S delete_module -F key=mod-unload the SYSCALL record doesn't tell us what module was requested for unloading. Use the new KERN_MODULE auxiliary record to record it. The SYSCALL record result code will list the return code. See: https://github.com/linux-audit/audit-kernel/issues/37 https://github.com/linux-audit/audit-kernel/issues/7 https://github.com/linux-audit/audit-kernel/wiki/RFE-Module-Load-Record-FormatSigned-off-by:
Richard Guy Briggs <rgb@redhat.com> Acked-by:
Jessica Yu <jeyu@redhat.com> Signed-off-by:
Paul Moore <paul@paul-moore.com>
f6276ac9