Files
kernel_arpi/include/uapi/linux
Richard Guy Briggs 42d5e37654 audit: filter PATH records keyed on filesystem magic
Tracefs or debugfs were causing hundreds to thousands of PATH records to
be associated with the init_module and finit_module SYSCALL records on a
few modules when the following rule was in place for startup:
	-a always,exit -F arch=x86_64 -S init_module -F key=mod-load

Provide a method to ignore these large number of PATH records from
overwhelming the logs if they are not of interest.  Introduce a new
filter list "AUDIT_FILTER_FS", with a new field type AUDIT_FSTYPE,
which keys off the filesystem 4-octet hexadecimal magic identifier to
filter specific filesystem PATH records.

An example rule would look like:
	-a never,filesystem -F fstype=0x74726163 -F key=ignore_tracefs
	-a never,filesystem -F fstype=0x64626720 -F key=ignore_debugfs

Arguably the better way to address this issue is to disable tracefs and
debugfs on boot from production systems.

See: https://github.com/linux-audit/audit-kernel/issues/16
See: https://github.com/linux-audit/audit-userspace/issues/8
Test case: https://github.com/linux-audit/audit-testsuite/issues/42

Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
[PM: fixed the whitespace damage in kernel/auditsc.c]
Signed-off-by: Paul Moore <paul@paul-moore.com>
2017-11-10 16:08:56 -05:00
..
2016-10-18 10:05:42 -06:00
2017-07-03 02:22:52 -07:00
2017-06-20 06:54:34 -03:00
2016-10-01 07:32:32 +02:00
2017-03-25 20:11:19 -07:00
2017-04-24 12:35:56 -04:00
2017-01-10 14:05:11 -05:00
2017-06-23 13:42:20 -04:00
2017-02-03 15:16:45 -05:00
2016-11-03 15:41:11 -04:00
2016-11-03 15:41:11 -04:00
2017-07-06 16:24:30 -07:00
2017-01-17 14:38:43 -05:00
2017-05-30 08:20:25 -06:00
2017-02-20 11:13:37 -05:00
2016-09-27 21:52:00 -04:00
2016-09-27 21:52:00 -04:00
2017-07-01 15:26:11 -07:00
2017-01-09 16:07:38 -05:00
2017-03-09 15:42:33 +01:00
2017-01-10 18:31:55 -08:00
2017-06-15 12:12:40 -04:00
2017-06-05 16:58:59 +02:00
2017-03-31 12:55:06 +02:00
2016-12-16 00:13:38 +02:00
2016-12-16 00:13:32 +02:00
2017-04-24 12:35:56 -04:00