Re: [PATCH v2] audit: add FSOPEN record to log filesystem name

[Paul Moore]

On Tue, Jul 7, 2026 at 7:23 AM Christian Brauner <brauner@xxxxxxxxxx> wrote:
>
> > Modern mount tools (util-linux >= 2.39.1) use the new mount API
> > (fsopen, fsconfig, fsmount, move_mount) instead of the legacy mount(2)
> > syscall. The generic SYSCALL audit record logs the fsopen syscall but
> > does not capture the filesystem name string, creating an audit gap for
> > filesystem mount operations.
> >
> > Add an FSOPEN auxiliary record that logs the dereferenced filesystem
> > name string passed to fsopen(2).
> >
> >   type=SYSCALL ... : arch=x86_64 syscall=fsopen ... a1=FSOPEN_CLOEXEC
> >   type=FSOPEN  ... : fs_name="tmpfs"
> >
> > Link: https://github.com/linux-audit/audit-kernel/issues/152
> > Signed-off-by: Ricardo Robaina <rrobaina@xxxxxxxxxx>
>
> I need a hint from the audit people whether this is ok or not...

It's in the queue to take a closer look, need to get the stable-7.2
stuff out first.

Are you okay with the VFS addition Christian?  If so, an ACK would be
appreciated as this is something we would want to merge via the audit
tree and not the VFS tree.

-- 
paul-moore.com