diff options
| author | Ricardo Robaina <rrobaina@redhat.com> | 2026-07-03 09:25:49 -0300 |
|---|---|---|
| committer | Paul Moore <paul@paul-moore.com> | 2026-10-04 07:33:18 -0400 |
| commit | 5d59024a6cc9aa9300da59fbf7e2c29f1f2393c6 (patch) | |
| tree | a40f778a6ff42496e6a67ca77f550c7f625bae0f /include/linux | |
| parent | cee9395acd8043be0644b25c34bfa86623f2b935 (diff) | |
| download | linux-5d59024a6cc9aa9300da59fbf7e2c29f1f2393c6.tar.gz linux-5d59024a6cc9aa9300da59fbf7e2c29f1f2393c6.zip | |
audit: add FSOPEN record to log filesystem name
Modern mount tools (util-linux >= 2.39.1) use the new mount API
(fsopen, fsconfig, fsmount, move_mount) instead of the legacy mount(2)
syscall. The generic SYSCALL audit record logs the fsopen syscall but
does not capture the filesystem name string, creating an audit gap for
filesystem mount operations.
Add an FSOPEN auxiliary record that logs the dereferenced filesystem
name string passed to fsopen(2).
type=SYSCALL ... : arch=x86_64 syscall=fsopen ... a1=FSOPEN_CLOEXEC
type=FSOPEN ... : fs_name="tmpfs"
Link: https://github.com/linux-audit/audit-kernel/issues/152
Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
Reviewed-by: Richard Guy Briggs <rgb@redhat.com>
[PM: Christian Brauner commented "Seems fine"]
Signed-off-by: Paul Moore <paul@paul-moore.com>
Diffstat (limited to 'include/linux')
| -rw-r--r-- | include/linux/audit.h | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/include/linux/audit.h b/include/linux/audit.h index 45abb3722d30..077b2667180d 100644 --- a/include/linux/audit.h +++ b/include/linux/audit.h @@ -449,6 +449,7 @@ extern void __audit_tk_injoffset(struct timespec64 offset); extern void __audit_ntp_log(const struct audit_ntp_data *ad); extern void __audit_log_nfcfg(const char *name, u8 af, unsigned int nentries, enum audit_nfcfgop op, gfp_t gfp); +extern void __audit_log_fsopen(const char *fs_name); static inline void audit_ipc_obj(struct kern_ipc_perm *ipcp) { @@ -598,6 +599,12 @@ static inline void audit_log_nfcfg(const char *name, u8 af, __audit_log_nfcfg(name, af, nentries, op, gfp); } +static inline void audit_log_fsopen(const char *fs_name) +{ + if (!audit_dummy_context()) + __audit_log_fsopen(fs_name); +} + extern int audit_n_rules; extern int audit_signals; #else /* CONFIG_AUDITSYSCALL */ @@ -730,6 +737,9 @@ static inline void audit_log_nfcfg(const char *name, u8 af, enum audit_nfcfgop op, gfp_t gfp) { } +static inline void audit_log_fsopen(const char *fs_name) +{ } + #define audit_n_rules 0 #define audit_signals 0 #endif /* CONFIG_AUDITSYSCALL */ |