[PATCH ALT5] audit: ignore module syscalls on inode child

2017-03-03 Thread Richard Guy Briggs
Tracefs or debugfs were causing hundreds to thousands of null PATH records to be associated with the init_module and finit_module SYSCALL records on a few modules when the following rule was in place for startup: -a always,exit -F arch=x86_64 -S init_module -F key=mod-load In

[PATCH ALT5] audit: ignore module syscalls on inode child

2017-03-03 Thread Richard Guy Briggs
Tracefs or debugfs were causing hundreds to thousands of null PATH records to be associated with the init_module and finit_module SYSCALL records on a few modules when the following rule was in place for startup: -a always,exit -F arch=x86_64 -S init_module -F key=mod-load In