File: 43-module-load.rules

package info (click to toggle)
audit 1%3A4.1.2-1
  • links: PTS, VCS
  • area: main
  • in suites: forky, sid
  • size: 4,468 kB
  • sloc: ansic: 61,684; makefile: 1,664; python: 1,647; sh: 417; sed: 32
file content (6 lines) | stat: -rw-r--r-- 398 bytes parent folder | download | duplicates (4) 
1
2
3
4
5
6
 
## These rules watch for kernel module insertion. By monitoring
## the syscall, we do not need any watches on programs.
-a always,exit -F arch=b32 -S init_module,finit_module -F key=module-load
-a always,exit -F arch=b64 -S init_module,finit_module -F key=module-load
-a always,exit -F arch=b32 -S delete_module -F key=module-unload
-a always,exit -F arch=b64 -S delete_module -F key=module-unload