On Tue, Jul 7, 2026 at 7:23 AM Christian Brauner <[email protected]> wrote: > > > Modern mount tools (util-linux >= 2.39.1) use the new mount API > > (fsopen, fsconfig, fsmount, move_mount) instead of the legacy mount(2) > > syscall. The generic SYSCALL audit record logs the fsopen syscall but > > does not capture the filesystem name string, creating an audit gap for > > filesystem mount operations. > > > > Add an FSOPEN auxiliary record that logs the dereferenced filesystem > > name string passed to fsopen(2). > > > > type=SYSCALL ... : arch=x86_64 syscall=fsopen ... a1=FSOPEN_CLOEXEC > > type=FSOPEN ... : fs_name="tmpfs" > > > > Link: https://github.com/linux-audit/audit-kernel/issues/152 > > Signed-off-by: Ricardo Robaina <[email protected]> > > I need a hint from the audit people whether this is ok or not...
It's in the queue to take a closer look, need to get the stable-7.2 stuff out first. Are you okay with the VFS addition Christian? If so, an ACK would be appreciated as this is something we would want to merge via the audit tree and not the VFS tree. -- paul-moore.com
