Re: [PATCH] audit: add MOVE_MOUNT auxiliary record to log mount relocation
Christian Brauner <[email protected]> Wed, 22 Jul 2026 17:59:07 +0200
| Newsgroups | org.kernel.vger.audit,org.kernel.vger.linux-fsdevel,org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <20260722-hecht-bauch-eiskunstlauf-7e2cab5ae9bc@brauner> |
On 2026-07-13 14:00 -0300, Ricardo Robaina wrote: > Modern mount tools (util-linux >= 2.39.1) use the new mount API > (fsopen, fsconfig, fsmount, move_mount) instead of the legacy mount(2) > syscall. The generic SYSCALL audit record logs the move_mount syscall > but does not capture the flags argument, creating an audit gap for > mount relocation operations. > > Add a MOVE_MOUNT auxiliary record that logs the flags argument passed > to move_mount(2). Pathnames and file descriptors are captured through > existing PATH records and SYSCALL record arguments. > > ---- > type=PATH : item=0 name=/mnt/test_src inode=1 dev=00:41 ... > type=SYSCALL : arch=x86_64 syscall=move_mount ... > type=MOVE_MOUNT : fs_flags=0x4 > ---- > type=PATH : item=0 name=/mnt/test_dst inode=27460862 dev=fc:00 ... > type=SYSCALL : arch=x86_64 syscall=move_mount ... > type=MOVE_MOUNT : fs_flags=0x4 > > Link: https://github.com/linux-audit/audit-kernel/issues/152 > Link: https://github.com/linux-audit/audit-kernel/issues/153 > Signed-off-by: Ricardo Robaina <[email protected]> > --- Acked-by: Christian Brauner <[email protected]>