Re: [PATCH v2] audit: add FSOPEN record to log filesystem name

Christian Brauner <[email protected]> Tue, 07 Jul 2026 13:23:02 +0200

Newsgroups	org.kernel.vger.audit,org.kernel.vger.linux-fsdevel,org.kernel.vger.linux-kernel
Message-ID	<20260707-sippenhaft-teufel-bergbahn-87d9652bea7f@brauner>

> Modern mount tools (util-linux >= 2.39.1) use the new mount API
> (fsopen, fsconfig, fsmount, move_mount) instead of the legacy mount(2)
> syscall. The generic SYSCALL audit record logs the fsopen syscall but
> does not capture the filesystem name string, creating an audit gap for
> filesystem mount operations.
> 
> Add an FSOPEN auxiliary record that logs the dereferenced filesystem
> name string passed to fsopen(2).
> 
>   type=SYSCALL ... : arch=x86_64 syscall=fsopen ... a1=FSOPEN_CLOEXEC
>   type=FSOPEN  ... : fs_name="tmpfs"
> 
> Link: https://github.com/linux-audit/audit-kernel/issues/152
> Signed-off-by: Ricardo Robaina <[email protected]>

I need a hint from the audit people whether this is ok or not...

-- 
Christian Brauner <[email protected]>