Skip to content

fstype: allow filtering of all supported file systems#520

Merged
stevegrubb merged 1 commit intolinux-audit:masterfrom
rmetrich:fstype
Mar 25, 2026
Merged

fstype: allow filtering of all supported file systems#520
stevegrubb merged 1 commit intolinux-audit:masterfrom
rmetrich:fstype

Conversation

@rmetrich
Copy link
Copy Markdown
Contributor

The code was only supporting debugfs and tracefs and the values were hardcoded.
This commit brings to for filtering all known file systems.

Credits for the shell script generator go to Sergio Correia.

@stevegrubb
Copy link
Copy Markdown
Contributor

Out of curiosity, why would we want to support all filesystems? The whole reason this exists at all is because debugfs and tracefs are pseudo filesystem that if they are watched (even accidentally) can hang the system or make it unresponsive like it has a heavy load. IOW, this was to enable the system to function normally. Opening this up to all file systems sounds like an easy way to shoot yourself in the foot.

@rmetrich
Copy link
Copy Markdown
Contributor Author

We want actually to also be able to avoid monitoring cgroup (/sys/fs/cgroup): when having CIS rules, a lot of hits show up because of systemd manipulating the cgroup hierarchy (on session creation/deletion for example).
Because admins may want to exclude whatever they want, I believe we should open filtering to anything, it's then admin's responsibility.

@stevegrubb
Copy link
Copy Markdown
Contributor

Cgroups & cgroup2 sounds reasonable and are in the same spirit as what motivated the original fix.

@rmetrich
Copy link
Copy Markdown
Contributor Author

OK, then shall I keep the generating code but limit it to tracefs, debugfs, cgroup for now (so that if we want to add more in the future, it's easy) or shall I rollback to hardcoding the MAGIC ID?

@stevegrubb
Copy link
Copy Markdown
Contributor

I prefer the hardcoded magic numbers. This is portable so that every distro has the same ones.

This is useful to avoid syscall hits on cgroup hierarchy manipulation
heavily performed by systemd, typically when having CIS rules in place.

Signed-off-by: Renaud Métrich <rmetrich@redhat.com>
@stevegrubb stevegrubb merged commit 1744322 into linux-audit:master Mar 25, 2026
@stevegrubb
Copy link
Copy Markdown
Contributor

Thanks.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants