Tracefs or debugfs were causing hundreds to thousands of PATH records to be associated with the init_module and finit_module SYSCALL records on a few modules when the following rule was in place for startup: -a always,exit -F arch=x86_64 -S init_module -F key=mod-load Provide a method to ignore these large number of PATH records from overwhelming the logs if they are not of interest. Introduce a new filter list "AUDIT_FILTER_FS", with a new field type AUDIT_FSTYPE, which keys off the filesystem 4-octet hexadecimal magic identifier to filter specific filesystem PATH records. An example rule would look like: -a never,filesystem -F fstype=0x74726163 -F key=ignore_tracefs -a never,filesystem -F fstype=0x64626720 -F key=ignore_debugfs Arguably the better way to address this issue is to disable tracefs and debugfs on boot from production systems. See: https://github.com/linux-audit/audit-kernel/issues/16 See: https://github.com/linux-audit/audit-userspace/issues/8 Test case: https://github.com/linux-audit/audit-testsuite/issues/42
Showing the changes to include/uapi/linux (1 of 3 files). Show all
Unified · Split
| @@ -155,8 +155,9 @@ · 154 unmodified lines | |||
| 155 | #define AUDIT_FILTER_WATCH 0x03 /* Apply rule to file system watches */ | 155 | #define AUDIT_FILTER_WATCH 0x03 /* Apply rule to file system watches */ |
| 156 | #define AUDIT_FILTER_EXIT 0x04 /* Apply rule at syscall exit */ | 156 | #define AUDIT_FILTER_EXIT 0x04 /* Apply rule at syscall exit */ |
| 157 | #define AUDIT_FILTER_TYPE 0x05 /* Apply rule at audit_log_start */ | 157 | #define AUDIT_FILTER_TYPE 0x05 /* Apply rule at audit_log_start */ |
| 158 | #define AUDIT_FILTER_FS 0x06 /* Apply rule at __audit_inode_child */ | ||
| 158 | 159 | ||
| 159 | #define AUDIT_NR_FILTERS 6 | 160 | #define AUDIT_NR_FILTERS 7 |
| 160 | 161 | ||
| 161 | #define AUDIT_FILTER_PREPEND 0x10 /* Prepend to front of list */ | 162 | #define AUDIT_FILTER_PREPEND 0x10 /* Prepend to front of list */ |
| 162 | 163 | ||
| @@ -256,6 +257,7 @@ · 93 unmodified lines | |||
| 256 | #define AUDIT_OBJ_LEV_HIGH 23 | 257 | #define AUDIT_OBJ_LEV_HIGH 23 |
| 257 | #define AUDIT_LOGINUID_SET 24 | 258 | #define AUDIT_LOGINUID_SET 24 |
| 258 | #define AUDIT_SESSIONID 25 /* Session ID */ | 259 | #define AUDIT_SESSIONID 25 /* Session ID */ |
| 260 | #define AUDIT_FSTYPE 26 /* FileSystem Type */ | ||
| 259 | 261 | ||
| 260 | /* These are ONLY useful when checking | 262 | /* These are ONLY useful when checking |
| 261 | * at syscall exit time (AUDIT_AT_EXIT). */ | 263 | * at syscall exit time (AUDIT_AT_EXIT). */ |
| @@ -335,13 +337,15 @@ enum { · 73 unmodified lines | |||
| 335 | #define AUDIT_FEATURE_BITMAP_EXCLUDE_EXTEND 0x00000008 | 337 | #define AUDIT_FEATURE_BITMAP_EXCLUDE_EXTEND 0x00000008 |
| 336 | #define AUDIT_FEATURE_BITMAP_SESSIONID_FILTER 0x00000010 | 338 | #define AUDIT_FEATURE_BITMAP_SESSIONID_FILTER 0x00000010 |
| 337 | #define AUDIT_FEATURE_BITMAP_LOST_RESET 0x00000020 | 339 | #define AUDIT_FEATURE_BITMAP_LOST_RESET 0x00000020 |
| 340 | #define AUDIT_FEATURE_BITMAP_FILTER_FS 0x00000040 | ||
| 338 | 341 | ||
| 339 | #define AUDIT_FEATURE_BITMAP_ALL (AUDIT_FEATURE_BITMAP_BACKLOG_LIMIT | \ | 342 | #define AUDIT_FEATURE_BITMAP_ALL (AUDIT_FEATURE_BITMAP_BACKLOG_LIMIT | \ |
| 340 | AUDIT_FEATURE_BITMAP_BACKLOG_WAIT_TIME | \ | 343 | AUDIT_FEATURE_BITMAP_BACKLOG_WAIT_TIME | \ |
| 341 | AUDIT_FEATURE_BITMAP_EXECUTABLE_PATH | \ | 344 | AUDIT_FEATURE_BITMAP_EXECUTABLE_PATH | \ |
| 342 | AUDIT_FEATURE_BITMAP_EXCLUDE_EXTEND | \ | 345 | AUDIT_FEATURE_BITMAP_EXCLUDE_EXTEND | \ |
| 343 | AUDIT_FEATURE_BITMAP_SESSIONID_FILTER | \ | 346 | AUDIT_FEATURE_BITMAP_SESSIONID_FILTER | \ |
| 344 | AUDIT_FEATURE_BITMAP_LOST_RESET) | 347 | AUDIT_FEATURE_BITMAP_LOST_RESET | \ |
| 348 | AUDIT_FEATURE_BITMAP_FILTER_FS) | ||
| 345 | 349 | ||
| 346 | /* deprecated: AUDIT_VERSION_* */ | 350 | /* deprecated: AUDIT_VERSION_* */ |
| 347 | #define AUDIT_VERSION_LATEST AUDIT_FEATURE_BITMAP_ALL | 351 | #define AUDIT_VERSION_LATEST AUDIT_FEATURE_BITMAP_ALL |