aboutsummaryrefslogtreecommitdiffstats
path: root/security/smack
diff options
context:
space:
mode:
authorRichard Guy Briggs <rgb@redhat.com>2019-01-23 13:34:59 -0500
committerPaul Moore <paul@paul-moore.com>2019-01-25 16:12:55 -0500
commita252f56a3c922197ef40dce8f8cc258ae75e0193 (patch)
tree76998437c6dc721ac70e480ccc5081aa0ed52d01 /security/smack
parentaudit: add support for fcaps v3 (diff)
downloadlinux-dev-a252f56a3c922197ef40dce8f8cc258ae75e0193.tar.xz
linux-dev-a252f56a3c922197ef40dce8f8cc258ae75e0193.zip
audit: more filter PATH records keyed on filesystem magic
Like commit 42d5e37654e4 ("audit: filter PATH records keyed on filesystem magic") that addresses https://github.com/linux-audit/audit-kernel/issues/8 Any user or remote filesystem could become unavailable and effectively block on a forced unmount. -a always,exit -S umount2 -F key=umount2 Provide a method to ignore these user and remote filesystems to prevent them from being impossible to unmount. Extend the "AUDIT_FILTER_FS" filter that uses the field type AUDIT_FSTYPE keying off the filesystem 4-octet hexadecimal magic identifier to filter specific filesystems to cover audit_inode() to address this blockage. An example rule would look like: -a never,filesystem -F fstype=0x517B -F key=ignore_smb -a never,filesystem -F fstype=0x6969 -F key=ignore_nfs Arguably the better way to address this issue is to disable auditing processes that touch removable filesystems. Note: refactor __audit_inode_child() to remove two levels of if indentation. Please see the github issue tracker https://github.com/linux-audit/audit-kernel/issues/100 Signed-off-by: Richard Guy Briggs <rgb@redhat.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
Diffstat (limited to 'security/smack')
0 files changed, 0 insertions, 0 deletions