audit-kernel icon indicating copy to clipboard operation
audit-kernel copied to clipboard

BUG: make best effort to identify null path records

Open rgbriggs opened this issue 6 years ago • 1 comments

Split off from https://github.com/linux-audit/audit-kernel/issues/8 which has been closed to allow one approach of the two to go through. The ability to filter out a particular filesystem that is causing issues has been accepted upstream in commit 3d7810b ("audit: filter PATH records keyed on filesystem magic"). The test to check this was added in commit 589b34b ("tests_manual: ghak8 test for PATH record filesystem filter").

This new issue will address the identification of such PATH records, filling out the name field with something more useful than "(null)". The following patch was originally accpted upstream in the audit/next tree, but then an 11th hour objection caused it to be reverted: commit 41e1f7b ("audit: show fstype:pathname for entries with anonymous parents"). Similarly, its test was accepted in commit b383f56 ("tests_manual: ghak8 test for module init PATH NULL records") but then reverted in commit 713e286b98ff ("Revert "tests_manual: ghak8 test for module init PATH NULL records"").

rgbriggs avatar Mar 03 '19 01:03 rgbriggs

@rgbriggs I'm assuming you want this assigned to you? If not let me know and I'll fix the assignment.

pcmoore avatar Mar 04 '19 16:03 pcmoore