fstype: allow filtering of all supported file systems#520
fstype: allow filtering of all supported file systems#520stevegrubb merged 1 commit intolinux-audit:masterfrom
Conversation
|
Out of curiosity, why would we want to support all filesystems? The whole reason this exists at all is because debugfs and tracefs are pseudo filesystem that if they are watched (even accidentally) can hang the system or make it unresponsive like it has a heavy load. IOW, this was to enable the system to function normally. Opening this up to all file systems sounds like an easy way to shoot yourself in the foot. |
|
We want actually to also be able to avoid monitoring cgroup (/sys/fs/cgroup): when having CIS rules, a lot of hits show up because of systemd manipulating the cgroup hierarchy (on session creation/deletion for example). |
|
Cgroups & cgroup2 sounds reasonable and are in the same spirit as what motivated the original fix. |
|
OK, then shall I keep the generating code but limit it to tracefs, debugfs, cgroup for now (so that if we want to add more in the future, it's easy) or shall I rollback to hardcoding the MAGIC ID? |
|
I prefer the hardcoded magic numbers. This is portable so that every distro has the same ones. |
This is useful to avoid syscall hits on cgroup hierarchy manipulation heavily performed by systemd, typically when having CIS rules in place. Signed-off-by: Renaud Métrich <rmetrich@redhat.com>
|
Thanks. |
The code was only supporting debugfs and tracefs and the values were hardcoded.
This commit brings to for filtering all known file systems.
Credits for the shell script generator go to Sergio Correia.