On 2026-07-13 14:00 -0300, Ricardo Robaina wrote: > Modern mount tools (util-linux >= 2.39.1) use the new mount API > (fsopen, fsconfig, fsmount, move_mount) instead of the legacy mount(2) > syscall. The generic SYSCALL audit record logs the fsconfig syscall but > does not capture the configuration parameters, creating an audit gap for > critical mount information such as the device being mounted. > > Add an FSCONFIG auxiliary record that logs the command type, parameter > name (key), parameter value, and aux parameter passed to fsconfig(2). > > ---- > type=SYSCALL : syscall=fsconfig a1=FSCONFIG_SET_STRING ... > type=FSCONFIG : fs_cmd=1 fs_key=source fs_val="tmpfs" fs_aux=0 > ---- > type=SYSCALL : syscall=fsconfig a1=FSCONFIG_CMD_CREATE ... > type=FSCONFIG : fs_cmd=6 fs_key=(null) fs_val=(null) fs_aux=0 > ---- > type=SYSCALL : syscall=fsconfig a0=0x4 a1=FSCONFIG_SET_BINARY ... > type=FSCONFIG : fs_cmd=2 fs_key=hidepid fs_val="<binary>" fs_aux=4 > > Link: https://github.com/linux-audit/audit-kernel/issues/153 > Signed-off-by: Ricardo Robaina <[email protected]> > ---
Acked-by: Christian Brauner <[email protected]>
