mbox series

[v4,0/2] minimal run-time audit support

Message ID 20230226111637.1541915-1-stsp2@yandex.ru
Headers show
Series minimal run-time audit support | expand

Message

stsp Feb. 26, 2023, 11:16 a.m. UTC 
Changes in v4: rebased, conflicts resolved.

Changes in v3: address the review comment of Jonathon Anderson:
Disable 3 audit call-backs for dynamically loaded modules. Namely
symbind, pltenter, pltexit. Extend test-case to make sure they
are not resolved and not called.

Changes in v2: address the review comment of Jonathon Anderson:
Add per-linkmap l_naudit counter to make sure each object is audited
only with the modules loaded before it. That avoids the possibility
of getting the "unrecognized" cookie. Test-case was enhanced to check
for unrecognized cookies.

This patch-set introduces the bare minimum functionality for working
with audit modules at run-time.

Patch1 fixes the check in dlmopen() which avoids loading solibs into
the auditing namespace. But RTLD_NOLOAD was forgotten to check, and
with that flags nothing gets loaded into auditing namespace, so dlmopen()
should succeed and return the handle for auditing object.

Patch2 adds dlload_audit_module() function and a test-case for it.