diff options
| author | Ricardo Robaina <rrobaina@redhat.com> | 2026-07-03 09:25:49 -0300 |
|---|---|---|
| committer | Paul Moore <paul@paul-moore.com> | 2026-10-04 07:33:18 -0400 |
| commit | 5d59024a6cc9aa9300da59fbf7e2c29f1f2393c6 (patch) | |
| tree | a40f778a6ff42496e6a67ca77f550c7f625bae0f /include/uapi/linux | |
| parent | cee9395acd8043be0644b25c34bfa86623f2b935 (diff) | |
audit: add FSOPEN record to log filesystem name
Modern mount tools (util-linux >= 2.39.1) use the new mount API
(fsopen, fsconfig, fsmount, move_mount) instead of the legacy mount(2)
syscall. The generic SYSCALL audit record logs the fsopen syscall but
does not capture the filesystem name string, creating an audit gap for
filesystem mount operations.
Add an FSOPEN auxiliary record that logs the dereferenced filesystem
name string passed to fsopen(2).
type=SYSCALL ... : arch=x86_64 syscall=fsopen ... a1=FSOPEN_CLOEXEC
type=FSOPEN ... : fs_name="tmpfs"
Link: https://github.com/linux-audit/audit-kernel/issues/152
Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
Reviewed-by: Richard Guy Briggs <rgb@redhat.com>
[PM: Christian Brauner commented "Seems fine"]
Signed-off-by: Paul Moore <paul@paul-moore.com>
Diffstat (limited to 'include/uapi/linux')
| -rw-r--r-- | include/uapi/linux/audit.h | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h index e8f5ce677df7..abae0524746e 100644 --- a/include/uapi/linux/audit.h +++ b/include/uapi/linux/audit.h @@ -122,6 +122,7 @@ #define AUDIT_OPENAT2 1337 /* Record showing openat2 how args */ #define AUDIT_DM_CTRL 1338 /* Device Mapper target control */ #define AUDIT_DM_EVENT 1339 /* Device Mapper events */ +#define AUDIT_FSOPEN 1340 /* Record showing fsopen fs_name arg */ #define AUDIT_AVC 1400 /* SE Linux avc denial or grant */ #define AUDIT_SELINUX_ERR 1401 /* Internal SE Linux Errors */ |