On Mon, Jul 13, 2026 at 1:00 PM Ricardo Robaina <[email protected]> wrote: > > Modern mount tools (util-linux >= 2.39.1) use the new mount API > (fsopen, fsconfig, fsmount, move_mount) instead of the legacy mount(2) > syscall. The generic SYSCALL audit record logs the move_mount syscall > but does not capture the flags argument, creating an audit gap for > mount relocation operations. > > Add a MOVE_MOUNT auxiliary record that logs the flags argument passed > to move_mount(2). Pathnames and file descriptors are captured through > existing PATH records and SYSCALL record arguments. > > ---- > type=PATH : item=0 name=/mnt/test_src inode=1 dev=00:41 ... > type=SYSCALL : arch=x86_64 syscall=move_mount ... > type=MOVE_MOUNT : fs_flags=0x4 > ---- > type=PATH : item=0 name=/mnt/test_dst inode=27460862 dev=fc:00 ... > type=SYSCALL : arch=x86_64 syscall=move_mount ... > type=MOVE_MOUNT : fs_flags=0x4 > > Link: https://github.com/linux-audit/audit-kernel/issues/152 > Link: https://github.com/linux-audit/audit-kernel/issues/153 > Signed-off-by: Ricardo Robaina <[email protected]> > --- > fs/namespace.c | 3 +++ > include/linux/audit.h | 10 ++++++++++ > include/uapi/linux/audit.h | 1 + > kernel/auditsc.c | 13 +++++++++++++ > 4 files changed, 27 insertions(+)
This is because we only log the first four syscall parameters, correct? To put this another way, if we logged all six syscall parameters this wouldn't be an issue, yes? I'm aware of the argument for only logging the first four parameters, but I've always thought it was a rather foolish decision. Perhaps now is the time to spend to investigate adding those two missing parameters to the SYSCALL record so we don't have to worry about hacky workarounds like this (to be clear, I know this hacky workaround isn't your fault, you are just trying to make the best of a kludgy thing <g>). -- paul-moore.com
