audit: more filter PATH records keyed on filesystem magic
authorRichard Guy Briggs <rgb@redhat.com>
Wed, 23 Jan 2019 18:34:59 +0000 (13:34 -0500)
committerPaul Moore <paul@paul-moore.com>
Fri, 25 Jan 2019 21:12:55 +0000 (16:12 -0500)
commita252f56a3c922197ef40dce8f8cc258ae75e0193
tree76998437c6dc721ac70e480ccc5081aa0ed52d01
parent2fec30e245a3b46fef89c4cb1f74eefc5fbb29a6
audit: more filter PATH records keyed on filesystem magic

Like commit 42d5e37654e4 ("audit: filter PATH records keyed on
filesystem magic") that addresses
https://github.com/linux-audit/audit-kernel/issues/8

Any user or remote filesystem could become unavailable and effectively
block on a forced unmount.

    -a always,exit -S umount2 -F key=umount2

Provide a method to ignore these user and remote filesystems to prevent
them from being impossible to unmount.

Extend the "AUDIT_FILTER_FS" filter that uses the field type
AUDIT_FSTYPE keying off the filesystem 4-octet hexadecimal magic
identifier to filter specific filesystems to cover audit_inode() to address
this blockage.

An example rule would look like:
    -a never,filesystem -F fstype=0x517B -F key=ignore_smb
    -a never,filesystem -F fstype=0x6969 -F key=ignore_nfs

Arguably the better way to address this issue is to disable auditing
processes that touch removable filesystems.

Note: refactor __audit_inode_child() to remove two levels of if
indentation.

Please see the github issue tracker
https://github.com/linux-audit/audit-kernel/issues/100

Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
kernel/auditsc.c