> Modern mount tools (util-linux >= 2.39.1) use the new mount API > (fsopen, fsconfig, fsmount, move_mount) instead of the legacy mount(2) > syscall. The generic SYSCALL audit record logs the fsopen syscall but > does not capture the filesystem name string, creating an audit gap for > filesystem mount operations. > > Add an FSOPEN auxiliary record that logs the dereferenced filesystem > name string passed to fsopen(2). > > type=SYSCALL ... : arch=x86_64 syscall=fsopen ... a1=FSOPEN_CLOEXEC > type=FSOPEN ... : fs_name="tmpfs" > > Link: https://github.com/linux-audit/audit-kernel/issues/152 > Signed-off-by: Ricardo Robaina <[email protected]>
I need a hint from the audit people whether this is ok or not... -- Christian Brauner <[email protected]>
