From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 738F0C433EF for ; Thu, 28 Oct 2021 19:49:36 +0000 (UTC) Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [216.205.24.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id E80AB610FD for ; Thu, 28 Oct 2021 19:49:35 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.1 mail.kernel.org E80AB610FD Authentication-Results: mail.kernel.org; dmarc=pass (p=none dis=none) header.from=redhat.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=redhat.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1635450574; h=from:from:sender:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding:list-id:list-help: list-unsubscribe:list-subscribe:list-post; bh=vl80NQP5yhhDiVLOnuImtxQYHm6e2AHE/CrqQaDqPWY=; b=R//KA+t4C499uaZG9RD1YdnQ41G0V34H8Js11Vxxm13ywRz3Ft/vdFMBmQlNElPCCSBqPQ 5eZYr6SX8wJQglc7m0Omd5StuwtkPvE9VH/V++3q0qgZ5CS2oGw5Ziov2kG0ajvt3UvWTw aKF7Lz5biZMv/WOV9OzmofhrtoPhimg= Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-561-TepNiYf8M36ede_w46b6uw-1; Thu, 28 Oct 2021 15:49:31 -0400 X-MC-Unique: TepNiYf8M36ede_w46b6uw-1 Received: from smtp.corp.redhat.com (int-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.12]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id DFF6C100C660; Thu, 28 Oct 2021 19:49:27 +0000 (UTC) Received: from colo-mx.corp.redhat.com (colo-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.20]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 7C00B60BF1; Thu, 28 Oct 2021 19:49:27 +0000 (UTC) Received: from lists01.pubmisc.prod.ext.phx2.redhat.com (lists01.pubmisc.prod.ext.phx2.redhat.com [10.5.19.33]) by colo-mx.corp.redhat.com (Postfix) with ESMTP id 1D1EA1800B9C; Thu, 28 Oct 2021 19:49:27 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.11]) by lists01.pubmisc.prod.ext.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id 19SJnPMn020594 for ; Thu, 28 Oct 2021 15:49:25 -0400 Received: by smtp.corp.redhat.com (Postfix) id E489969119; Thu, 28 Oct 2021 19:49:25 +0000 (UTC) Received: from madcap2.tricolour.com (unknown [10.3.128.2]) by smtp.corp.redhat.com (Postfix) with ESMTP id 14620604CC; Thu, 28 Oct 2021 19:49:16 +0000 (UTC) From: Richard Guy Briggs To: Linux-Audit Mailing List Subject: [PATCH v1] add filesystem filter list to auditctl usage Date: Thu, 28 Oct 2021 15:49:12 -0400 Message-Id: <20211028194912.3101108-1-rgb@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.79 on 10.5.11.11 X-loop: linux-audit@redhat.com Cc: Richard Guy Briggs X-BeenThere: linux-audit@redhat.com X-Mailman-Version: 2.1.12 Precedence: junk List-Id: Linux Audit Discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com X-Scanned-By: MIMEDefang 2.79 on 10.5.11.12 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=linux-audit-bounces@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit The "filesystem" filter was added 2017-10-05 with commit 38ec69344689ac7886812890cb3e2cc97c0c112c ("filter: add filesystem filter with fstype") Add the list name to the usage text. Signed-off-by: Richard Guy Briggs --- docs/audit.rules.7 | 4 ++-- src/auditctl.c | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/audit.rules.7 b/docs/audit.rules.7 index 0325c153772d..40263ec6807d 100644 --- a/docs/audit.rules.7 +++ b/docs/audit.rules.7 @@ -43,7 +43,7 @@ rule. .SS System Call The system call rules are loaded into a matching engine that intercepts each syscall that all programs on the system makes. Therefore it is very important to only use syscall rules when you have to since these affect performance. The more rules, the bigger the performance hit. You can help the performance, though, by combining syscalls into one rule whenever possible. -The Linux kernel has 4 rule matching lists or filters as they are sometimes called. They are: task, exit, user, and exclude. The task list is checked only during the fork or clone syscalls. It is rarely used in practice. +The Linux kernel has 5 rule matching lists or filters as they are sometimes called. They are: task, exit, user, exclude and filesystem. The task list is checked only during the fork or clone syscalls. It is rarely used in practice. The exit filter is the place where all syscall and file system audit requests are evaluated. @@ -71,7 +71,7 @@ option tells the kernel's rule matching engine that we want to append a rule at .RE The action and list are separated by a comma but no space in between. Valid lists are: -.IR task ", " exit ", " user ", and " exclude ". Their meaning was explained earlier. +.IR task ", " exit ", " user ", " exclude ", and " filesystem ". Their meaning was explained earlier. Next in the rule would normally be the .B \-S diff --git a/src/auditctl.c b/src/auditctl.c index 06bb747c5fd2..f9bfc2a247d2 100644 --- a/src/auditctl.c +++ b/src/auditctl.c @@ -110,7 +110,7 @@ static void usage(void) " -C f=f Compare collected fields if available:\n" " Field name, operator(=,!=), field name\n" " -d Delete rule from ist with ction\n" - " l=task,exit,user,exclude\n" + " l=task,exit,user,exclude,filesystem\n" " a=never,always\n" " -D Delete all rules and watches\n" " -e [0..2] Set enabled flag\n" -- 2.27.0 -- Linux-audit mailing list Linux-audit@redhat.com https://listman.redhat.com/mailman/listinfo/linux-audit