fix: audit kernel_module_request hook

awandke · awandke · commit eb42240ef22d · 2025-11-03T19:45:03.000Z
Signed-off-by: Alan Wandke &lt;adwandk@uwe.nsa.gov&gt;
diff --git a/bpf/src/seabee/seabee.bpf.c b/bpf/src/seabee/seabee.bpf.c
@@ -484,7 +484,7 @@ int BPF_PROG(seabee_kernel_module_request, char *kmod_name)
 		log_kernel_module_request(LOG_LEVEL_WARN, LOG_REASON_DENY,
 		                          (const unsigned char *)kmod_name);
 		return DENY;
-	} else if (kmod_modification == (u32)SECURITY_BLOCK) {
+	} else if (kmod_modification == (u32)SECURITY_AUDIT) {
 		log_kernel_module_request(LOG_LEVEL_INFO, LOG_REASON_AUDIT,
 		                          (const unsigned char *)kmod_name);
 	}

Original file line number	Diff line number	Diff line change
`@@ -484,7 +484,7 @@ int BPF_PROG(seabee_kernel_module_request, char *kmod_name)`
`484`	`484`	`log_kernel_module_request(LOG_LEVEL_WARN, LOG_REASON_DENY,`
`485`	`485`	`(const unsigned char *)kmod_name);`
`486`	`486`	`return DENY;`
`487`		`- } else if (kmod_modification == (u32)SECURITY_BLOCK) {`
	`487`	`+ } else if (kmod_modification == (u32)SECURITY_AUDIT) {`
`488`	`488`	`log_kernel_module_request(LOG_LEVEL_INFO, LOG_REASON_AUDIT,`
`489`	`489`	`(const unsigned char *)kmod_name);`
`490`	`490`	`}`