Tracefs or debugfs were causing hundreds to thousands of PATH records to be associated with the init_module and finit_module SYSCALL records on a few modules when the following rule was in place for startup: -a always,exit -F arch=x86_64 -S init_module -F key=mod-load Provide a method to ignore these large number of PATH records from overwhelming the logs if they are not of interest. Introduce a new filter list "AUDIT_FILTER_FS", with a new field type AUDIT_FSTYPE, which keys off the filesystem 4-octet hexadecimal magic identifier to filter specific filesystem PATH records. An example rule would look like: -a never,filesystem -F fstype=0x74726163 -F key=ignore_tracefs -a never,filesystem -F fstype=0x64626720 -F key=ignore_debugfs Arguably the better way to address this issue is to disable tracefs and debugfs on boot from production systems. See: https://github.com/linux-audit/audit-kernel/issues/16 See: https://github.com/linux-audit/audit-userspace/issues/8 Test case: https://github.com/linux-audit/audit-testsuite/issues/42
Showing the changes to include/uapi/linux (1 of 3 files). Show all
Unified · Split
| @@ -155,8 +155,9 @@ · 154 unmodified lines | ||
| 155 | 155 | #define AUDIT_FILTER_WATCH 0x03 /* Apply rule to file system watches */ |
| 156 | 156 | #define AUDIT_FILTER_EXIT 0x04 /* Apply rule at syscall exit */ |
| 157 | 157 | #define AUDIT_FILTER_TYPE 0x05 /* Apply rule at audit_log_start */ |
| 158 | +#define AUDIT_FILTER_FS 0x06 /* Apply rule at __audit_inode_child */ | |
| 158 | 159 | |
| 159 | −#define AUDIT_NR_FILTERS 6 | |
| 160 | +#define AUDIT_NR_FILTERS 7 | |
| 160 | 161 | |
| 161 | 162 | #define AUDIT_FILTER_PREPEND 0x10 /* Prepend to front of list */ |
| 162 | 163 | |
| @@ -256,6 +257,7 @@ · 93 unmodified lines | ||
| 256 | 257 | #define AUDIT_OBJ_LEV_HIGH 23 |
| 257 | 258 | #define AUDIT_LOGINUID_SET 24 |
| 258 | 259 | #define AUDIT_SESSIONID 25 /* Session ID */ |
| 260 | +#define AUDIT_FSTYPE 26 /* FileSystem Type */ | |
| 259 | 261 | |
| 260 | 262 | /* These are ONLY useful when checking |
| 261 | 263 | * at syscall exit time (AUDIT_AT_EXIT). */ |
| @@ -335,13 +337,15 @@ enum { · 73 unmodified lines | ||
| 335 | 337 | #define AUDIT_FEATURE_BITMAP_EXCLUDE_EXTEND 0x00000008 |
| 336 | 338 | #define AUDIT_FEATURE_BITMAP_SESSIONID_FILTER 0x00000010 |
| 337 | 339 | #define AUDIT_FEATURE_BITMAP_LOST_RESET 0x00000020 |
| 340 | +#define AUDIT_FEATURE_BITMAP_FILTER_FS 0x00000040 | |
| 338 | 341 | |
| 339 | 342 | #define AUDIT_FEATURE_BITMAP_ALL (AUDIT_FEATURE_BITMAP_BACKLOG_LIMIT | \ |
| 340 | 343 | AUDIT_FEATURE_BITMAP_BACKLOG_WAIT_TIME | \ |
| 341 | 344 | AUDIT_FEATURE_BITMAP_EXECUTABLE_PATH | \ |
| 342 | 345 | AUDIT_FEATURE_BITMAP_EXCLUDE_EXTEND | \ |
| 343 | 346 | AUDIT_FEATURE_BITMAP_SESSIONID_FILTER | \ |
| 344 | − AUDIT_FEATURE_BITMAP_LOST_RESET) | |
| 347 | + AUDIT_FEATURE_BITMAP_LOST_RESET | \ | |
| 348 | + AUDIT_FEATURE_BITMAP_FILTER_FS) | |
| 345 | 349 | |
| 346 | 350 | /* deprecated: AUDIT_VERSION_* */ |
| 347 | 351 | #define AUDIT_VERSION_LATEST AUDIT_FEATURE_BITMAP_ALL |