Re: [PATCH v2] audit: add missing syscalls to PERM class tables

[Paul Moore]

On Jun 12, 2026 Ricardo Robaina <rrobaina@xxxxxxxxxx> wrote:
> 
> Add missing file metadata syscalls to the audit PERM class tables,
> addressing gaps where certain file operations were not properly
> classified for audit rule matching.
> 
> Changes:
> - audit_change_attr.h: Add file_setattr
> 
> - audit_read.h: Add quotactl_fd, file_getattr, stat, stat64, lstat,
>   lstat64, fstat, fstat64, newfstatat, fstatat64, and statx
> 
> - audit_write.h: Add quotactl_fd
> 
> Architecture-specific and conditionally-compiled syscalls are guarded
> with #ifdef.
> 
> Signed-off-by: Steve Grubb <sgrubb@xxxxxxxxxx>
> Signed-off-by: Ricardo Robaina <rrobaina@xxxxxxxxxx>
> ---
> Changes in v2:
> - Added stat64 family syscalls (stat64, lstat64, fstat64, fstatat64) to
>   audit_read.h for 32-bit architecture support.
> - Dropped timestamp-related syscalls (utime, utimes, utimensat, etc.)
>   due to potential audit log volume increase impact. Those will be
>   addressed in a separate patch after closer investigation.
> 
>  include/asm-generic/audit_change_attr.h |  3 +++
>  include/asm-generic/audit_read.h        | 31 +++++++++++++++++++++++++
>  include/asm-generic/audit_write.h       |  3 +++
>  3 files changed, 37 insertions(+)

Looks good to me, merged into audit/dev, thanks.

--
paul-moore.com