[PATCH] audit: add FSOPEN record to log filesystem name

[PATCH] audit: add FSOPEN record to log filesystem name

[Ricardo Robaina]

Modern mount tools (util-linux >= 2.39.1) use the new mount API
(fsopen, fsconfig, fsmount, move_mount) instead of the legacy mount(2)
syscall. The generic SYSCALL audit record logs the fsopen syscall but
does not capture the filesystem name string, creating an audit gap for
filesystem mount operations.

Add an FSOPEN auxiliary record that logs the dereferenced filesystem
name string passed to fsopen(2).

  type=SYSCALL ... : arch=x86_64 syscall=fsopen ... a1=FSOPEN_CLOEXEC
  type=FSOPEN  ... : fs_name="tmpfs"

Link: https://github.com/linux-audit/audit-kernel/issues/152
Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
---
 fs/fsopen.c                |  3 +++
 include/linux/audit.h      | 10 ++++++++++
 include/uapi/linux/audit.h |  1 +
 kernel/auditsc.c           | 13 +++++++++++++
 4 files changed, 27 insertions(+)

diff --git a/fs/fsopen.c b/fs/fsopen.c
index ae19e5136598..8b07f9d42be2 100644
--- a/fs/fsopen.c
+++ b/fs/fsopen.c
@@ -15,6 +15,7 @@
 #include <linux/namei.h>
 #include <linux/file.h>
 #include <uapi/linux/mount.h>
+#include <linux/audit.h>
 #include "internal.h"
 #include "mount.h"
 
@@ -150,6 +151,8 @@ SYSCALL_DEFINE2(fsopen, const char __user *, _fs_name, unsigned int, flags)
 	if (ret < 0)
 		goto err_fc;
 
+	audit_log_fsopen(fs_name);
+
 	return fscontext_create_fd(fc, flags & FSOPEN_CLOEXEC ? O_CLOEXEC : 0);
 
 err_fc:
diff --git a/include/linux/audit.h b/include/linux/audit.h
index 45abb3722d30..077b2667180d 100644
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -449,6 +449,7 @@ extern void __audit_tk_injoffset(struct timespec64 offset);
 extern void __audit_ntp_log(const struct audit_ntp_data *ad);
 extern void __audit_log_nfcfg(const char *name, u8 af, unsigned int nentries,
 			      enum audit_nfcfgop op, gfp_t gfp);
+extern void __audit_log_fsopen(const char *fs_name);
 
 static inline void audit_ipc_obj(struct kern_ipc_perm *ipcp)
 {
@@ -598,6 +599,12 @@ static inline void audit_log_nfcfg(const char *name, u8 af,
 		__audit_log_nfcfg(name, af, nentries, op, gfp);
 }
 
+static inline void audit_log_fsopen(const char *fs_name)
+{
+	if (!audit_dummy_context())
+		__audit_log_fsopen(fs_name);
+}
+
 extern int audit_n_rules;
 extern int audit_signals;
 #else /* CONFIG_AUDITSYSCALL */
@@ -730,6 +737,9 @@ static inline void audit_log_nfcfg(const char *name, u8 af,
 				   enum audit_nfcfgop op, gfp_t gfp)
 { }
 
+static inline void audit_log_fsopen(const char *fs_name)
+{ }
+
 #define audit_n_rules 0
 #define audit_signals 0
 #endif /* CONFIG_AUDITSYSCALL */
diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h
index e8f5ce677df7..abae0524746e 100644
--- a/include/uapi/linux/audit.h
+++ b/include/uapi/linux/audit.h
@@ -122,6 +122,7 @@
 #define AUDIT_OPENAT2		1337	/* Record showing openat2 how args */
 #define AUDIT_DM_CTRL		1338	/* Device Mapper target control */
 #define AUDIT_DM_EVENT		1339	/* Device Mapper events */
+#define AUDIT_FSOPEN		1340	/* Record showing fsopen fs_name arg */
 
 #define AUDIT_AVC		1400	/* SE Linux avc denial or grant */
 #define AUDIT_SELINUX_ERR	1401	/* Internal SE Linux Errors */
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 6610e667c728..c82fd5606de5 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -2882,6 +2882,19 @@ void __audit_log_nfcfg(const char *name, u8 af, unsigned int nentries,
 }
 EXPORT_SYMBOL_GPL(__audit_log_nfcfg);
 
+void __audit_log_fsopen(const char *fs_name)
+{
+	struct audit_buffer *ab;
+
+	ab = audit_log_start(audit_context(), GFP_KERNEL, AUDIT_FSOPEN);
+	if (!ab)
+		return;
+
+	audit_log_format(ab, "fs_name=");
+	audit_log_untrustedstring(ab, fs_name);
+	audit_log_end(ab);
+}
+
 static void audit_log_task(struct audit_buffer *ab)
 {
 	kuid_t auid, uid;
-- 
2.53.0

Re: [PATCH] audit: add FSOPEN record to log filesystem name

[Christian Brauner]

> Modern mount tools (util-linux >= 2.39.1) use the new mount API
> (fsopen, fsconfig, fsmount, move_mount) instead of the legacy mount(2)
> syscall. The generic SYSCALL audit record logs the fsopen syscall but
> does not capture the filesystem name string, creating an audit gap for
> filesystem mount operations.
> 
> Add an FSOPEN auxiliary record that logs the dereferenced filesystem
> name string passed to fsopen(2).
> 
>   type=SYSCALL ... : arch=x86_64 syscall=fsopen ... a1=FSOPEN_CLOEXEC
>   type=FSOPEN  ... : fs_name="tmpfs"
> 
> Link: https://github.com/linux-audit/audit-kernel/issues/152
> Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
>
> diff --git a/fs/fsopen.c b/fs/fsopen.c
> index ae19e5136598..8b07f9d42be2 100644
> --- a/fs/fsopen.c
> +++ b/fs/fsopen.c
> @@ -15,6 +15,7 @@
>  #include <linux/namei.h>
>  #include <linux/file.h>
>  #include <uapi/linux/mount.h>
> +#include <linux/audit.h>
>  #include "internal.h"
>  #include "mount.h"
>  
> @@ -150,6 +151,8 @@ SYSCALL_DEFINE2(fsopen, const char __user *, _fs_name, unsigned int, flags)
>  	if (ret < 0)
>  		goto err_fc;
>  
> +	audit_log_fsopen(fs_name);

Right above:

	fs_type = get_fs_type(fs_name);
	kfree(fs_name);
	if (!fs_type)
		return -ENODEV;

So that's a UAF.

-- 
Christian Brauner <brauner@kernel.org>

Re: [PATCH] audit: add FSOPEN record to log filesystem name

[Ricardo Robaina]

On Thu, Jul 2, 2026 at 3:59 AM Christian Brauner <brauner@kernel.org> wrote:
>
> > Modern mount tools (util-linux >= 2.39.1) use the new mount API
> > (fsopen, fsconfig, fsmount, move_mount) instead of the legacy mount(2)
> > syscall. The generic SYSCALL audit record logs the fsopen syscall but
> > does not capture the filesystem name string, creating an audit gap for
> > filesystem mount operations.
> >
> > Add an FSOPEN auxiliary record that logs the dereferenced filesystem
> > name string passed to fsopen(2).
> >
> >   type=SYSCALL ... : arch=x86_64 syscall=fsopen ... a1=FSOPEN_CLOEXEC
> >   type=FSOPEN  ... : fs_name="tmpfs"
> >
> > Link: https://github.com/linux-audit/audit-kernel/issues/152
> > Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
> >
> > diff --git a/fs/fsopen.c b/fs/fsopen.c
> > index ae19e5136598..8b07f9d42be2 100644
> > --- a/fs/fsopen.c
> > +++ b/fs/fsopen.c
> > @@ -15,6 +15,7 @@
> >  #include <linux/namei.h>
> >  #include <linux/file.h>
> >  #include <uapi/linux/mount.h>
> > +#include <linux/audit.h>
> >  #include "internal.h"
> >  #include "mount.h"
> >
> > @@ -150,6 +151,8 @@ SYSCALL_DEFINE2(fsopen, const char __user *, _fs_name, unsigned int, flags)
> >       if (ret < 0)
> >               goto err_fc;
> >
> > +     audit_log_fsopen(fs_name);
>
> Right above:
>
>         fs_type = get_fs_type(fs_name);
>         kfree(fs_name);
>         if (!fs_type)
>                 return -ENODEV;
>
> So that's a UAF.
>
> --
> Christian Brauner <brauner@kernel.org>
>

Thanks for reviewing this patch, Christian!

You're right, I missed that. I'll be sending a v2 shortly.

-Ricardo

Re: [PATCH] audit: add FSOPEN record to log filesystem name

[kernel test robot]

BCC: lkp@intel.com
CC: oe-kbuild-all@lists.linux.dev
In-Reply-To: <20260701132410.711205-1-rrobaina@redhat.com>
References: <20260701132410.711205-1-rrobaina@redhat.com>
TO: Ricardo Robaina <rrobaina@redhat.com>
TO: audit@vger.kernel.org
TO: linux-fsdevel@vger.kernel.org
TO: linux-kernel@vger.kernel.org
CC: paul@paul-moore.com
CC: eparis@redhat.com
CC: viro@zeniv.linux.org.uk
CC: brauner@kernel.org
CC: jack@suse.cz
CC: Ricardo Robaina <rrobaina@redhat.com>

Hi Ricardo,

kernel test robot noticed the following build warnings:

[auto build test WARNING on pcmoore-audit/next]
[also build test WARNING on brauner-vfs/vfs.all linus/master v7.2-rc6 next-20260807]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Ricardo-Robaina/audit-add-FSOPEN-record-to-log-filesystem-name/20260807-192421
base:   https://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit.git next
patch link:    https://lore.kernel.org/r/20260701132410.711205-1-rrobaina%40redhat.com
patch subject: [PATCH] audit: add FSOPEN record to log filesystem name
:::::: branch date: 14 hours ago
:::::: commit date: 14 hours ago
config: sparc-randconfig-r071-20260808 (https://download.01.org/0day-ci/archive/20260808/202608080923.Lf400oFq-lkp@intel.com/config)
compiler: sparc-linux-gcc (GCC) 8.5.0
smatch: v0.5.0-9187-g5189e3fb

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202608080923.Lf400oFq-lkp@intel.com/

New smatch warnings:
fs/fsopen.c:154 __do_sys_fsopen() warn: passing freed memory 'fs_name' (line 139)
fs/fsopen.c:154 __do_sys_fsopen() warn: passing freed memory 'fs_name' (line 139)

Old smatch warnings:
fs/fsopen.c:481 __do_sys_fsconfig() warn: variable dereferenced before check 'param.name' (see line 450)
fs/fsopen.c:481 __do_sys_fsconfig() warn: variable dereferenced before check 'param.name' (see line 450)

vim +/fs_name +154 fs/fsopen.c

007ec26cdc9fef David Howells   2018-11-01  113  
24dcb3d90a1f67 David Howells   2018-11-01  114  /*
24dcb3d90a1f67 David Howells   2018-11-01  115   * Open a filesystem by name so that it can be configured for mounting.
24dcb3d90a1f67 David Howells   2018-11-01  116   *
24dcb3d90a1f67 David Howells   2018-11-01  117   * We are allowed to specify a container in which the filesystem will be
24dcb3d90a1f67 David Howells   2018-11-01  118   * opened, thereby indicating which namespaces will be used (notably, which
24dcb3d90a1f67 David Howells   2018-11-01  119   * network namespace will be used for network filesystems).
24dcb3d90a1f67 David Howells   2018-11-01  120   */
24dcb3d90a1f67 David Howells   2018-11-01  121  SYSCALL_DEFINE2(fsopen, const char __user *, _fs_name, unsigned int, flags)
24dcb3d90a1f67 David Howells   2018-11-01  122  {
24dcb3d90a1f67 David Howells   2018-11-01  123  	struct file_system_type *fs_type;
24dcb3d90a1f67 David Howells   2018-11-01  124  	struct fs_context *fc;
24dcb3d90a1f67 David Howells   2018-11-01  125  	const char *fs_name;
007ec26cdc9fef David Howells   2018-11-01  126  	int ret;
24dcb3d90a1f67 David Howells   2018-11-01  127  
a5f85d7834f7e1 Al Viro         2022-03-01  128  	if (!may_mount())
24dcb3d90a1f67 David Howells   2018-11-01  129  		return -EPERM;
24dcb3d90a1f67 David Howells   2018-11-01  130  
24dcb3d90a1f67 David Howells   2018-11-01  131  	if (flags & ~FSOPEN_CLOEXEC)
24dcb3d90a1f67 David Howells   2018-11-01  132  		return -EINVAL;
24dcb3d90a1f67 David Howells   2018-11-01  133  
24dcb3d90a1f67 David Howells   2018-11-01  134  	fs_name = strndup_user(_fs_name, PAGE_SIZE);
24dcb3d90a1f67 David Howells   2018-11-01  135  	if (IS_ERR(fs_name))
24dcb3d90a1f67 David Howells   2018-11-01  136  		return PTR_ERR(fs_name);
24dcb3d90a1f67 David Howells   2018-11-01  137  
24dcb3d90a1f67 David Howells   2018-11-01  138  	fs_type = get_fs_type(fs_name);
24dcb3d90a1f67 David Howells   2018-11-01 @139  	kfree(fs_name);
24dcb3d90a1f67 David Howells   2018-11-01  140  	if (!fs_type)
24dcb3d90a1f67 David Howells   2018-11-01  141  		return -ENODEV;
24dcb3d90a1f67 David Howells   2018-11-01  142  
24dcb3d90a1f67 David Howells   2018-11-01  143  	fc = fs_context_for_mount(fs_type, 0);
24dcb3d90a1f67 David Howells   2018-11-01  144  	put_filesystem(fs_type);
24dcb3d90a1f67 David Howells   2018-11-01  145  	if (IS_ERR(fc))
24dcb3d90a1f67 David Howells   2018-11-01  146  		return PTR_ERR(fc);
24dcb3d90a1f67 David Howells   2018-11-01  147  
24dcb3d90a1f67 David Howells   2018-11-01  148  	fc->phase = FS_CONTEXT_CREATE_PARAMS;
007ec26cdc9fef David Howells   2018-11-01  149  
007ec26cdc9fef David Howells   2018-11-01  150  	ret = fscontext_alloc_log(fc);
007ec26cdc9fef David Howells   2018-11-01  151  	if (ret < 0)
007ec26cdc9fef David Howells   2018-11-01  152  		goto err_fc;
007ec26cdc9fef David Howells   2018-11-01  153  
aee6439c3eb4ef Ricardo Robaina 2026-07-01 @154  	audit_log_fsopen(fs_name);
aee6439c3eb4ef Ricardo Robaina 2026-07-01  155  
24dcb3d90a1f67 David Howells   2018-11-01  156  	return fscontext_create_fd(fc, flags & FSOPEN_CLOEXEC ? O_CLOEXEC : 0);
007ec26cdc9fef David Howells   2018-11-01  157  
007ec26cdc9fef David Howells   2018-11-01  158  err_fc:
007ec26cdc9fef David Howells   2018-11-01  159  	put_fs_context(fc);
007ec26cdc9fef David Howells   2018-11-01  160  	return ret;
24dcb3d90a1f67 David Howells   2018-11-01  161  }
ecdab150fddb42 David Howells   2018-11-01  162  

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki