Re: [PATCH] audit: add MOVE_MOUNT auxiliary record to log mount relocation

[Christian Brauner]

On 2026-07-13 14:00 -0300, Ricardo Robaina wrote:
> Modern mount tools (util-linux >= 2.39.1) use the new mount API
> (fsopen, fsconfig, fsmount, move_mount) instead of the legacy mount(2)
> syscall. The generic SYSCALL audit record logs the move_mount syscall
> but does not capture the flags argument, creating an audit gap for
> mount relocation operations.
> 
> Add a MOVE_MOUNT auxiliary record that logs the flags argument passed
> to move_mount(2). Pathnames and file descriptors are captured through
> existing PATH records and SYSCALL record arguments.
> 
>  ----
>  type=PATH : item=0 name=/mnt/test_src inode=1 dev=00:41 ...
>  type=SYSCALL : arch=x86_64 syscall=move_mount ...
>  type=MOVE_MOUNT : fs_flags=0x4
>  ----
>  type=PATH : item=0 name=/mnt/test_dst inode=27460862 dev=fc:00 ...
>  type=SYSCALL : arch=x86_64 syscall=move_mount ...
>  type=MOVE_MOUNT : fs_flags=0x4
> 
> Link: https://github.com/linux-audit/audit-kernel/issues/152
> Link: https://github.com/linux-audit/audit-kernel/issues/153
> Signed-off-by: Ricardo Robaina <rrobaina@xxxxxxxxxx>
> ---

Acked-by: Christian Brauner <brauner@xxxxxxxxxx>