[PATCH] audit: add MOVE_MOUNT auxiliary record to log mount relocation

[PATCH] audit: add MOVE_MOUNT auxiliary record to log mount relocation

[Ricardo Robaina]

Modern mount tools (util-linux >= 2.39.1) use the new mount API
(fsopen, fsconfig, fsmount, move_mount) instead of the legacy mount(2)
syscall. The generic SYSCALL audit record logs the move_mount syscall
but does not capture the flags argument, creating an audit gap for
mount relocation operations.

Add a MOVE_MOUNT auxiliary record that logs the flags argument passed
to move_mount(2). Pathnames and file descriptors are captured through
existing PATH records and SYSCALL record arguments.

 ----
 type=PATH : item=0 name=/mnt/test_src inode=1 dev=00:41 ...
 type=SYSCALL : arch=x86_64 syscall=move_mount ...
 type=MOVE_MOUNT : fs_flags=0x4
 ----
 type=PATH : item=0 name=/mnt/test_dst inode=27460862 dev=fc:00 ...
 type=SYSCALL : arch=x86_64 syscall=move_mount ...
 type=MOVE_MOUNT : fs_flags=0x4

Link: https://github.com/linux-audit/audit-kernel/issues/152
Link: https://github.com/linux-audit/audit-kernel/issues/153
Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
---
 fs/namespace.c             |  3 +++
 include/linux/audit.h      | 10 ++++++++++
 include/uapi/linux/audit.h |  1 +
 kernel/auditsc.c           | 13 +++++++++++++
 4 files changed, 27 insertions(+)

diff --git a/fs/namespace.c b/fs/namespace.c
index 3d5cd5bf3b05..a6b0286744d9 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -34,6 +34,7 @@
 #include <linux/mnt_idmapping.h>
 #include <linux/pidfs.h>
 #include <linux/nstree.h>
+#include <linux/audit.h>
 
 #include "pnode.h"
 #include "internal.h"
@@ -4625,6 +4626,8 @@ SYSCALL_DEFINE5(move_mount,
 	if (flags & MOVE_MOUNT_F_EMPTY_PATH)
 		uflags = AT_EMPTY_PATH;
 
+	audit_log_move_mount(flags);
+
 	CLASS(filename_maybe_null,from_name)(from_pathname, uflags);
 	if (!from_name && from_dfd >= 0) {
 		CLASS(fd_raw, f_from)(from_dfd);
diff --git a/include/linux/audit.h b/include/linux/audit.h
index 45abb3722d30..d1dc4035cb3c 100644
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -449,6 +449,7 @@ extern void __audit_tk_injoffset(struct timespec64 offset);
 extern void __audit_ntp_log(const struct audit_ntp_data *ad);
 extern void __audit_log_nfcfg(const char *name, u8 af, unsigned int nentries,
 			      enum audit_nfcfgop op, gfp_t gfp);
+extern void __audit_log_move_mount(unsigned int flags);
 
 static inline void audit_ipc_obj(struct kern_ipc_perm *ipcp)
 {
@@ -598,6 +599,12 @@ static inline void audit_log_nfcfg(const char *name, u8 af,
 		__audit_log_nfcfg(name, af, nentries, op, gfp);
 }
 
+static inline void audit_log_move_mount(unsigned int flags)
+{
+	if (!audit_dummy_context())
+		__audit_log_move_mount(flags);
+}
+
 extern int audit_n_rules;
 extern int audit_signals;
 #else /* CONFIG_AUDITSYSCALL */
@@ -730,6 +737,9 @@ static inline void audit_log_nfcfg(const char *name, u8 af,
 				   enum audit_nfcfgop op, gfp_t gfp)
 { }
 
+static inline void audit_log_move_mount(unsigned int flags)
+{ }
+
 #define audit_n_rules 0
 #define audit_signals 0
 #endif /* CONFIG_AUDITSYSCALL */
diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h
index e8f5ce677df7..40abf3dfd307 100644
--- a/include/uapi/linux/audit.h
+++ b/include/uapi/linux/audit.h
@@ -122,6 +122,7 @@
 #define AUDIT_OPENAT2		1337	/* Record showing openat2 how args */
 #define AUDIT_DM_CTRL		1338	/* Device Mapper target control */
 #define AUDIT_DM_EVENT		1339	/* Device Mapper events */
+#define AUDIT_MOVE_MOUNT	1342	/* Record showing move_mount flags */
 
 #define AUDIT_AVC		1400	/* SE Linux avc denial or grant */
 #define AUDIT_SELINUX_ERR	1401	/* Internal SE Linux Errors */
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 6610e667c728..4aca04d33d00 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -2882,6 +2882,19 @@ void __audit_log_nfcfg(const char *name, u8 af, unsigned int nentries,
 }
 EXPORT_SYMBOL_GPL(__audit_log_nfcfg);
 
+void __audit_log_move_mount(unsigned int flags)
+{
+	struct audit_buffer *ab;
+
+	ab = audit_log_start(audit_context(), GFP_KERNEL,
+			     AUDIT_MOVE_MOUNT);
+	if (!ab)
+		return;
+
+	audit_log_format(ab, "fs_flags=0x%x", flags);
+	audit_log_end(ab);
+}
+
 static void audit_log_task(struct audit_buffer *ab)
 {
 	kuid_t auid, uid;
-- 
2.53.0

Re: [PATCH] audit: add MOVE_MOUNT auxiliary record to log mount relocation

[Richard Guy Briggs]

On 2026-07-13 14:00, Ricardo Robaina wrote:
> Modern mount tools (util-linux >= 2.39.1) use the new mount API
> (fsopen, fsconfig, fsmount, move_mount) instead of the legacy mount(2)
> syscall. The generic SYSCALL audit record logs the move_mount syscall
> but does not capture the flags argument, creating an audit gap for
> mount relocation operations.
> 
> Add a MOVE_MOUNT auxiliary record that logs the flags argument passed
> to move_mount(2). Pathnames and file descriptors are captured through
> existing PATH records and SYSCALL record arguments.
> 
>  ----
>  type=PATH : item=0 name=/mnt/test_src inode=1 dev=00:41 ...
>  type=SYSCALL : arch=x86_64 syscall=move_mount ...
>  type=MOVE_MOUNT : fs_flags=0x4
>  ----
>  type=PATH : item=0 name=/mnt/test_dst inode=27460862 dev=fc:00 ...
>  type=SYSCALL : arch=x86_64 syscall=move_mount ...
>  type=MOVE_MOUNT : fs_flags=0x4
> 
> Link: https://github.com/linux-audit/audit-kernel/issues/152
> Link: https://github.com/linux-audit/audit-kernel/issues/153
> Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>

Reviewed-by: Richard Guy Briggs <rgb@redhat.com>

> ---
>  fs/namespace.c             |  3 +++
>  include/linux/audit.h      | 10 ++++++++++
>  include/uapi/linux/audit.h |  1 +
>  kernel/auditsc.c           | 13 +++++++++++++
>  4 files changed, 27 insertions(+)
> 
> diff --git a/fs/namespace.c b/fs/namespace.c
> index 3d5cd5bf3b05..a6b0286744d9 100644
> --- a/fs/namespace.c
> +++ b/fs/namespace.c
> @@ -34,6 +34,7 @@
>  #include <linux/mnt_idmapping.h>
>  #include <linux/pidfs.h>
>  #include <linux/nstree.h>
> +#include <linux/audit.h>
>  
>  #include "pnode.h"
>  #include "internal.h"
> @@ -4625,6 +4626,8 @@ SYSCALL_DEFINE5(move_mount,
>  	if (flags & MOVE_MOUNT_F_EMPTY_PATH)
>  		uflags = AT_EMPTY_PATH;
>  
> +	audit_log_move_mount(flags);
> +
>  	CLASS(filename_maybe_null,from_name)(from_pathname, uflags);
>  	if (!from_name && from_dfd >= 0) {
>  		CLASS(fd_raw, f_from)(from_dfd);
> diff --git a/include/linux/audit.h b/include/linux/audit.h
> index 45abb3722d30..d1dc4035cb3c 100644
> --- a/include/linux/audit.h
> +++ b/include/linux/audit.h
> @@ -449,6 +449,7 @@ extern void __audit_tk_injoffset(struct timespec64 offset);
>  extern void __audit_ntp_log(const struct audit_ntp_data *ad);
>  extern void __audit_log_nfcfg(const char *name, u8 af, unsigned int nentries,
>  			      enum audit_nfcfgop op, gfp_t gfp);
> +extern void __audit_log_move_mount(unsigned int flags);
>  
>  static inline void audit_ipc_obj(struct kern_ipc_perm *ipcp)
>  {
> @@ -598,6 +599,12 @@ static inline void audit_log_nfcfg(const char *name, u8 af,
>  		__audit_log_nfcfg(name, af, nentries, op, gfp);
>  }
>  
> +static inline void audit_log_move_mount(unsigned int flags)
> +{
> +	if (!audit_dummy_context())
> +		__audit_log_move_mount(flags);
> +}
> +
>  extern int audit_n_rules;
>  extern int audit_signals;
>  #else /* CONFIG_AUDITSYSCALL */
> @@ -730,6 +737,9 @@ static inline void audit_log_nfcfg(const char *name, u8 af,
>  				   enum audit_nfcfgop op, gfp_t gfp)
>  { }
>  
> +static inline void audit_log_move_mount(unsigned int flags)
> +{ }
> +
>  #define audit_n_rules 0
>  #define audit_signals 0
>  #endif /* CONFIG_AUDITSYSCALL */
> diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h
> index e8f5ce677df7..40abf3dfd307 100644
> --- a/include/uapi/linux/audit.h
> +++ b/include/uapi/linux/audit.h
> @@ -122,6 +122,7 @@
>  #define AUDIT_OPENAT2		1337	/* Record showing openat2 how args */
>  #define AUDIT_DM_CTRL		1338	/* Device Mapper target control */
>  #define AUDIT_DM_EVENT		1339	/* Device Mapper events */
> +#define AUDIT_MOVE_MOUNT	1342	/* Record showing move_mount flags */
>  
>  #define AUDIT_AVC		1400	/* SE Linux avc denial or grant */
>  #define AUDIT_SELINUX_ERR	1401	/* Internal SE Linux Errors */
> diff --git a/kernel/auditsc.c b/kernel/auditsc.c
> index 6610e667c728..4aca04d33d00 100644
> --- a/kernel/auditsc.c
> +++ b/kernel/auditsc.c
> @@ -2882,6 +2882,19 @@ void __audit_log_nfcfg(const char *name, u8 af, unsigned int nentries,
>  }
>  EXPORT_SYMBOL_GPL(__audit_log_nfcfg);
>  
> +void __audit_log_move_mount(unsigned int flags)
> +{
> +	struct audit_buffer *ab;
> +
> +	ab = audit_log_start(audit_context(), GFP_KERNEL,
> +			     AUDIT_MOVE_MOUNT);
> +	if (!ab)
> +		return;
> +
> +	audit_log_format(ab, "fs_flags=0x%x", flags);
> +	audit_log_end(ab);
> +}
> +
>  static void audit_log_task(struct audit_buffer *ab)
>  {
>  	kuid_t auid, uid;
> -- 
> 2.53.0

- RGB

--
Richard Guy Briggs <rgb@redhat.com>
Sr. S/W Engineer, Kernel Security, Base Operating Systems
Remote, Ottawa, Red Hat Canada
Upstream IRC: SunRaycer
Voice: +1.613.860 2354 SMS: +1.613.518.6570

Re: [PATCH] audit: add MOVE_MOUNT auxiliary record to log mount relocation

[Christian Brauner]

On 2026-07-13 14:00 -0300, Ricardo Robaina wrote:
> Modern mount tools (util-linux >= 2.39.1) use the new mount API
> (fsopen, fsconfig, fsmount, move_mount) instead of the legacy mount(2)
> syscall. The generic SYSCALL audit record logs the move_mount syscall
> but does not capture the flags argument, creating an audit gap for
> mount relocation operations.
> 
> Add a MOVE_MOUNT auxiliary record that logs the flags argument passed
> to move_mount(2). Pathnames and file descriptors are captured through
> existing PATH records and SYSCALL record arguments.
> 
>  ----
>  type=PATH : item=0 name=/mnt/test_src inode=1 dev=00:41 ...
>  type=SYSCALL : arch=x86_64 syscall=move_mount ...
>  type=MOVE_MOUNT : fs_flags=0x4
>  ----
>  type=PATH : item=0 name=/mnt/test_dst inode=27460862 dev=fc:00 ...
>  type=SYSCALL : arch=x86_64 syscall=move_mount ...
>  type=MOVE_MOUNT : fs_flags=0x4
> 
> Link: https://github.com/linux-audit/audit-kernel/issues/152
> Link: https://github.com/linux-audit/audit-kernel/issues/153
> Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
> ---

Acked-by: Christian Brauner <brauner@kernel.org>

Re: [PATCH] audit: add MOVE_MOUNT auxiliary record to log mount relocation

[Paul Moore]

On Mon, Jul 13, 2026 at 1:00 PM Ricardo Robaina <rrobaina@redhat.com> wrote:
>
> Modern mount tools (util-linux >= 2.39.1) use the new mount API
> (fsopen, fsconfig, fsmount, move_mount) instead of the legacy mount(2)
> syscall. The generic SYSCALL audit record logs the move_mount syscall
> but does not capture the flags argument, creating an audit gap for
> mount relocation operations.
>
> Add a MOVE_MOUNT auxiliary record that logs the flags argument passed
> to move_mount(2). Pathnames and file descriptors are captured through
> existing PATH records and SYSCALL record arguments.
>
>  ----
>  type=PATH : item=0 name=/mnt/test_src inode=1 dev=00:41 ...
>  type=SYSCALL : arch=x86_64 syscall=move_mount ...
>  type=MOVE_MOUNT : fs_flags=0x4
>  ----
>  type=PATH : item=0 name=/mnt/test_dst inode=27460862 dev=fc:00 ...
>  type=SYSCALL : arch=x86_64 syscall=move_mount ...
>  type=MOVE_MOUNT : fs_flags=0x4
>
> Link: https://github.com/linux-audit/audit-kernel/issues/152
> Link: https://github.com/linux-audit/audit-kernel/issues/153
> Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
> ---
>  fs/namespace.c             |  3 +++
>  include/linux/audit.h      | 10 ++++++++++
>  include/uapi/linux/audit.h |  1 +
>  kernel/auditsc.c           | 13 +++++++++++++
>  4 files changed, 27 insertions(+)

This is because we only log the first four syscall parameters,
correct?  To put this another way, if we logged all six syscall
parameters this wouldn't be an issue, yes?

I'm aware of the argument for only logging the first four parameters,
but I've always thought it was a rather foolish decision.  Perhaps now
is the time to spend to investigate adding those two missing
parameters to the SYSCALL record so we don't have to worry about hacky
workarounds like this (to be clear, I know this hacky workaround isn't
your fault, you are just trying to make the best of a kludgy thing
<g>).

-- 
paul-moore.com

Re: [PATCH] audit: add MOVE_MOUNT auxiliary record to log mount relocation

[Ricardo Robaina]

On Tue, Jul 28, 2026 at 6:22 PM Paul Moore <paul@paul-moore.com> wrote:
>
> On Mon, Jul 13, 2026 at 1:00 PM Ricardo Robaina <rrobaina@redhat.com> wrote:
> >
> > Modern mount tools (util-linux >= 2.39.1) use the new mount API
> > (fsopen, fsconfig, fsmount, move_mount) instead of the legacy mount(2)
> > syscall. The generic SYSCALL audit record logs the move_mount syscall
> > but does not capture the flags argument, creating an audit gap for
> > mount relocation operations.
> >
> > Add a MOVE_MOUNT auxiliary record that logs the flags argument passed
> > to move_mount(2). Pathnames and file descriptors are captured through
> > existing PATH records and SYSCALL record arguments.
> >
> >  ----
> >  type=PATH : item=0 name=/mnt/test_src inode=1 dev=00:41 ...
> >  type=SYSCALL : arch=x86_64 syscall=move_mount ...
> >  type=MOVE_MOUNT : fs_flags=0x4
> >  ----
> >  type=PATH : item=0 name=/mnt/test_dst inode=27460862 dev=fc:00 ...
> >  type=SYSCALL : arch=x86_64 syscall=move_mount ...
> >  type=MOVE_MOUNT : fs_flags=0x4
> >
> > Link: https://github.com/linux-audit/audit-kernel/issues/152
> > Link: https://github.com/linux-audit/audit-kernel/issues/153
> > Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
> > ---
> >  fs/namespace.c             |  3 +++
> >  include/linux/audit.h      | 10 ++++++++++
> >  include/uapi/linux/audit.h |  1 +
> >  kernel/auditsc.c           | 13 +++++++++++++
> >  4 files changed, 27 insertions(+)
>

Thanks for reviewing this patch, Paul!

> This is because we only log the first four syscall parameters,
> correct?  To put this another way, if we logged all six syscall
> parameters this wouldn't be an issue, yes?

Yes, that's correct.

>
> I'm aware of the argument for only logging the first four parameters,
> but I've always thought it was a rather foolish decision.  Perhaps now
> is the time to spend to investigate adding those two missing
> parameters to the SYSCALL record so we don't have to worry about hacky
> workarounds like this (to be clear, I know this hacky workaround isn't
> your fault, you are just trying to make the best of a kludgy thing
> <g>).

I completely agree that's the right thing to do, and I'm happy to hear
that you'd be open to it.

I did a quick check and there are 100+ syscalls (~18% of the total)
with more than 4 arguments
 --around 67 of which pass audit-relevant scalars (flags, sizes,
modes) in the 5th or 6th position
that are currently lost.

I'll look into it. Please disregard this patch in the meantime.

>
> --
> paul-moore.com
>

-Ricardo

Re: [PATCH] audit: add MOVE_MOUNT auxiliary record to log mount relocation

[Steve Grubb]

On Wednesday, August 12, 2026 10:39:52 AM Eastern Daylight Time Ricardo 
Robaina wrote:
> On Tue, Jul 28, 2026 at 6:22 PM Paul Moore <paul@paul-moore.com> wrote:
> > On Mon, Jul 13, 2026 at 1:00 PM Ricardo Robaina <rrobaina@redhat.com> 
wrote:
> > > Modern mount tools (util-linux >= 2.39.1) use the new mount API
> > > (fsopen, fsconfig, fsmount, move_mount) instead of the legacy mount(2)
> > > syscall. The generic SYSCALL audit record logs the move_mount syscall
> > > but does not capture the flags argument, creating an audit gap for
> > > mount relocation operations.
> > > 
> > > Add a MOVE_MOUNT auxiliary record that logs the flags argument passed
> > > to move_mount(2). Pathnames and file descriptors are captured through
> > > existing PATH records and SYSCALL record arguments.
> > > 
> > >  ----
> > >  type=PATH : item=0 name=/mnt/test_src inode=1 dev=00:41 ...
> > >  type=SYSCALL : arch=x86_64 syscall=move_mount ...
> > >  type=MOVE_MOUNT : fs_flags=0x4
> > >  ----
> > >  type=PATH : item=0 name=/mnt/test_dst inode=27460862 dev=fc:00 ...
> > >  type=SYSCALL : arch=x86_64 syscall=move_mount ...
> > >  type=MOVE_MOUNT : fs_flags=0x4
> > > 
> > > Link: https://github.com/linux-audit/audit-kernel/issues/152
> > > Link: https://github.com/linux-audit/audit-kernel/issues/153
> > > Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
> > > ---
> > > 
> > >  fs/namespace.c             |  3 +++
> > >  include/linux/audit.h      | 10 ++++++++++
> > >  include/uapi/linux/audit.h |  1 +
> > >  kernel/auditsc.c           | 13 +++++++++++++
> > >  4 files changed, 27 insertions(+)
> 
> Thanks for reviewing this patch, Paul!
> 
> > This is because we only log the first four syscall parameters,
> > correct?  To put this another way, if we logged all six syscall
> > parameters this wouldn't be an issue, yes?
> 
> Yes, that's correct.

I've been aiming to reply to this and lost the original...in the case of 
mmap, yes. If we had just 5 of the passed values, we would not need a 
supplemental record just to record the fd.

However, in many other syscalls, we only have pointers. Sometimes syscalls 
are designed to pass a structure with config items where some are security 
relevant. In those cases having all the args doesn't help and we still need 
the supplemental record.

-Steve

> > I'm aware of the argument for only logging the first four parameters,
> > but I've always thought it was a rather foolish decision.  Perhaps now
> > is the time to spend to investigate adding those two missing
> > parameters to the SYSCALL record so we don't have to worry about hacky
> > workarounds like this (to be clear, I know this hacky workaround isn't
> > your fault, you are just trying to make the best of a kludgy thing
> > <g>).
> 
> I completely agree that's the right thing to do, and I'm happy to hear
> that you'd be open to it.
> 
> I did a quick check and there are 100+ syscalls (~18% of the total)
> with more than 4 arguments
>  --around 67 of which pass audit-relevant scalars (flags, sizes,
> modes) in the 5th or 6th position
> that are currently lost.
> 
> I'll look into it. Please disregard this patch in the meantime.
> 
> > --
> > paul-moore.com
> 
> -Ricardo

Re: [PATCH] audit: add MOVE_MOUNT auxiliary record to log mount relocation

[Paul Moore]

On Wed, Aug 12, 2026 at 10:40 AM Ricardo Robaina <rrobaina@redhat.com> wrote:
> On Tue, Jul 28, 2026 at 6:22 PM Paul Moore <paul@paul-moore.com> wrote:
> > On Mon, Jul 13, 2026 at 1:00 PM Ricardo Robaina <rrobaina@redhat.com> wrote:
> > >
> > > Modern mount tools (util-linux >= 2.39.1) use the new mount API
> > > (fsopen, fsconfig, fsmount, move_mount) instead of the legacy mount(2)
> > > syscall. The generic SYSCALL audit record logs the move_mount syscall
> > > but does not capture the flags argument, creating an audit gap for
> > > mount relocation operations.
> > >
> > > Add a MOVE_MOUNT auxiliary record that logs the flags argument passed
> > > to move_mount(2). Pathnames and file descriptors are captured through
> > > existing PATH records and SYSCALL record arguments.
> > >
> > >  ----
> > >  type=PATH : item=0 name=/mnt/test_src inode=1 dev=00:41 ...
> > >  type=SYSCALL : arch=x86_64 syscall=move_mount ...
> > >  type=MOVE_MOUNT : fs_flags=0x4
> > >  ----
> > >  type=PATH : item=0 name=/mnt/test_dst inode=27460862 dev=fc:00 ...
> > >  type=SYSCALL : arch=x86_64 syscall=move_mount ...
> > >  type=MOVE_MOUNT : fs_flags=0x4
> > >
> > > Link: https://github.com/linux-audit/audit-kernel/issues/152
> > > Link: https://github.com/linux-audit/audit-kernel/issues/153
> > > Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
> > > ---
> > >  fs/namespace.c             |  3 +++
> > >  include/linux/audit.h      | 10 ++++++++++
> > >  include/uapi/linux/audit.h |  1 +
> > >  kernel/auditsc.c           | 13 +++++++++++++
> > >  4 files changed, 27 insertions(+)
> >
>
> Thanks for reviewing this patch, Paul!
>
> > This is because we only log the first four syscall parameters,
> > correct?  To put this another way, if we logged all six syscall
> > parameters this wouldn't be an issue, yes?
>
> Yes, that's correct.
>
> > I'm aware of the argument for only logging the first four parameters,
> > but I've always thought it was a rather foolish decision.  Perhaps now
> > is the time to spend to investigate adding those two missing
> > parameters to the SYSCALL record so we don't have to worry about hacky
> > workarounds like this (to be clear, I know this hacky workaround isn't
> > your fault, you are just trying to make the best of a kludgy thing
> > <g>).
>
> I completely agree that's the right thing to do, and I'm happy to hear
> that you'd be open to it.
>
> I did a quick check and there are 100+ syscalls (~18% of the total)
> with more than 4 arguments
>  --around 67 of which pass audit-relevant scalars (flags, sizes,
> modes) in the 5th or 6th position
> that are currently lost.
>
> I'll look into it. Please disregard this patch in the meantime.

Thanks Ricardo, I think this would be a great improvement!

I'm particularly curious to see what old/existing userspace tooling
will do if we add the last two syscall arguments immediately after the
first four.  If we have to we can add them to the end, but if it
doesn't break anything it would be preferable to add them inline with
the other parameters.

-- 
paul-moore.com

Re: [PATCH] audit: add MOVE_MOUNT auxiliary record to log mount relocation

[Paul Moore]

On Wed, Aug 12, 2026 at 12:01 PM Steve Grubb <sgrubb@redhat.com> wrote:
> On Wednesday, August 12, 2026 10:39:52 AM Eastern Daylight Time Ricardo
> Robaina wrote:
> > On Tue, Jul 28, 2026 at 6:22 PM Paul Moore <paul@paul-moore.com> wrote:
> > > On Mon, Jul 13, 2026 at 1:00 PM Ricardo Robaina <rrobaina@redhat.com>
> wrote:
> > > > Modern mount tools (util-linux >= 2.39.1) use the new mount API
> > > > (fsopen, fsconfig, fsmount, move_mount) instead of the legacy mount(2)
> > > > syscall. The generic SYSCALL audit record logs the move_mount syscall
> > > > but does not capture the flags argument, creating an audit gap for
> > > > mount relocation operations.
> > > >
> > > > Add a MOVE_MOUNT auxiliary record that logs the flags argument passed
> > > > to move_mount(2). Pathnames and file descriptors are captured through
> > > > existing PATH records and SYSCALL record arguments.
> > > >
> > > >  ----
> > > >  type=PATH : item=0 name=/mnt/test_src inode=1 dev=00:41 ...
> > > >  type=SYSCALL : arch=x86_64 syscall=move_mount ...
> > > >  type=MOVE_MOUNT : fs_flags=0x4
> > > >  ----
> > > >  type=PATH : item=0 name=/mnt/test_dst inode=27460862 dev=fc:00 ...
> > > >  type=SYSCALL : arch=x86_64 syscall=move_mount ...
> > > >  type=MOVE_MOUNT : fs_flags=0x4
> > > >
> > > > Link: https://github.com/linux-audit/audit-kernel/issues/152
> > > > Link: https://github.com/linux-audit/audit-kernel/issues/153
> > > > Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
> > > > ---
> > > >
> > > >  fs/namespace.c             |  3 +++
> > > >  include/linux/audit.h      | 10 ++++++++++
> > > >  include/uapi/linux/audit.h |  1 +
> > > >  kernel/auditsc.c           | 13 +++++++++++++
> > > >  4 files changed, 27 insertions(+)
> >
> > Thanks for reviewing this patch, Paul!
> >
> > > This is because we only log the first four syscall parameters,
> > > correct?  To put this another way, if we logged all six syscall
> > > parameters this wouldn't be an issue, yes?
> >
> > Yes, that's correct.
>
> I've been aiming to reply to this and lost the original...in the case of
> mmap, yes. If we had just 5 of the passed values, we would not need a
> supplemental record just to record the fd.
>
> However, in many other syscalls, we only have pointers. Sometimes syscalls
> are designed to pass a structure with config items where some are security
> relevant. In those cases having all the args doesn't help and we still need
> the supplemental record.

True, but that is independent of logging all of the syscall
parameters.  In my opinion only logging the first four was a terrible
mistake (I know you disagree Steve) and I'd just assume we correct
that before we add an auxiliary record.

-- 
paul-moore.com

Re: [PATCH] audit: add MOVE_MOUNT auxiliary record to log mount relocation

[Steve Grubb]

On Wednesday, August 12, 2026 12:03:17 PM Eastern Daylight Time Paul Moore 
wrote:
> On Wed, Aug 12, 2026 at 10:40 AM Ricardo Robaina <rrobaina@redhat.com> 
wrote:
> > On Tue, Jul 28, 2026 at 6:22 PM Paul Moore <paul@paul-moore.com> wrote:
> > > On Mon, Jul 13, 2026 at 1:00 PM Ricardo Robaina <rrobaina@redhat.com> 
wrote:
> > > > Modern mount tools (util-linux >= 2.39.1) use the new mount API
> > > > (fsopen, fsconfig, fsmount, move_mount) instead of the legacy
> > > > mount(2)
> > > > syscall. The generic SYSCALL audit record logs the move_mount syscall
> > > > but does not capture the flags argument, creating an audit gap for
> > > > mount relocation operations.
> > > > 
> > > > Add a MOVE_MOUNT auxiliary record that logs the flags argument passed
> > > > to move_mount(2). Pathnames and file descriptors are captured through
> > > > existing PATH records and SYSCALL record arguments.
> > > > 
> > > >  ----
> > > >  type=PATH : item=0 name=/mnt/test_src inode=1 dev=00:41 ...
> > > >  type=SYSCALL : arch=x86_64 syscall=move_mount ...
> > > >  type=MOVE_MOUNT : fs_flags=0x4
> > > >  ----
> > > >  type=PATH : item=0 name=/mnt/test_dst inode=27460862 dev=fc:00 ...
> > > >  type=SYSCALL : arch=x86_64 syscall=move_mount ...
> > > >  type=MOVE_MOUNT : fs_flags=0x4
> > > > 
> > > > Link: https://github.com/linux-audit/audit-kernel/issues/152
> > > > Link: https://github.com/linux-audit/audit-kernel/issues/153
> > > > Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
> > > > ---
> > > > 
> > > >  fs/namespace.c             |  3 +++
> > > >  include/linux/audit.h      | 10 ++++++++++
> > > >  include/uapi/linux/audit.h |  1 +
> > > >  kernel/auditsc.c           | 13 +++++++++++++
> > > >  4 files changed, 27 insertions(+)
> > 
> > Thanks for reviewing this patch, Paul!
> > 
> > > This is because we only log the first four syscall parameters,
> > > correct?  To put this another way, if we logged all six syscall
> > > parameters this wouldn't be an issue, yes?
> > 
> > Yes, that's correct.
> > 
> > > I'm aware of the argument for only logging the first four parameters,
> > > but I've always thought it was a rather foolish decision.  Perhaps now
> > > is the time to spend to investigate adding those two missing
> > > parameters to the SYSCALL record so we don't have to worry about hacky
> > > workarounds like this (to be clear, I know this hacky workaround isn't
> > > your fault, you are just trying to make the best of a kludgy thing
> > > <g>).
> > 
> > I completely agree that's the right thing to do, and I'm happy to hear
> > that you'd be open to it.
> > 
> > I did a quick check and there are 100+ syscalls (~18% of the total)
> > with more than 4 arguments
> > 
> >  --around 67 of which pass audit-relevant scalars (flags, sizes,
> > 
> > modes) in the 5th or 6th position
> > that are currently lost.
> > 
> > I'll look into it. Please disregard this patch in the meantime.
> 
> Thanks Ricardo, I think this would be a great improvement!
> 
> I'm particularly curious to see what old/existing userspace tooling
> will do if we add the last two syscall arguments immediately after the
> first four.

It would ignore them. During search, it grabs a0 and a1, then skips to ppid. 
In the output phase, it should also ignore them since there's no code to 
interpret them.

> If we have to we can add them to the end, but if it
> doesn't break anything it would be preferable to add them inline with
> the other parameters.

I'd also prefer inline. That's the most natural view.

-Steve

Re: [PATCH] audit: add MOVE_MOUNT auxiliary record to log mount relocation

[Ricardo Robaina]

On Wed, Aug 12, 2026 at 5:19 PM Steve Grubb <sgrubb@redhat.com> wrote:
>
> On Wednesday, August 12, 2026 12:03:17 PM Eastern Daylight Time Paul Moore
> wrote:
> > On Wed, Aug 12, 2026 at 10:40 AM Ricardo Robaina <rrobaina@redhat.com>
> wrote:
> > > On Tue, Jul 28, 2026 at 6:22 PM Paul Moore <paul@paul-moore.com> wrote:
> > > > On Mon, Jul 13, 2026 at 1:00 PM Ricardo Robaina <rrobaina@redhat.com>
> wrote:
> > > > > Modern mount tools (util-linux >= 2.39.1) use the new mount API
> > > > > (fsopen, fsconfig, fsmount, move_mount) instead of the legacy
> > > > > mount(2)
> > > > > syscall. The generic SYSCALL audit record logs the move_mount syscall
> > > > > but does not capture the flags argument, creating an audit gap for
> > > > > mount relocation operations.
> > > > >
> > > > > Add a MOVE_MOUNT auxiliary record that logs the flags argument passed
> > > > > to move_mount(2). Pathnames and file descriptors are captured through
> > > > > existing PATH records and SYSCALL record arguments.
> > > > >
> > > > >  ----
> > > > >  type=PATH : item=0 name=/mnt/test_src inode=1 dev=00:41 ...
> > > > >  type=SYSCALL : arch=x86_64 syscall=move_mount ...
> > > > >  type=MOVE_MOUNT : fs_flags=0x4
> > > > >  ----
> > > > >  type=PATH : item=0 name=/mnt/test_dst inode=27460862 dev=fc:00 ...
> > > > >  type=SYSCALL : arch=x86_64 syscall=move_mount ...
> > > > >  type=MOVE_MOUNT : fs_flags=0x4
> > > > >
> > > > > Link: https://github.com/linux-audit/audit-kernel/issues/152
> > > > > Link: https://github.com/linux-audit/audit-kernel/issues/153
> > > > > Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
> > > > > ---
> > > > >
> > > > >  fs/namespace.c             |  3 +++
> > > > >  include/linux/audit.h      | 10 ++++++++++
> > > > >  include/uapi/linux/audit.h |  1 +
> > > > >  kernel/auditsc.c           | 13 +++++++++++++
> > > > >  4 files changed, 27 insertions(+)
> > >
> > > Thanks for reviewing this patch, Paul!
> > >
> > > > This is because we only log the first four syscall parameters,
> > > > correct?  To put this another way, if we logged all six syscall
> > > > parameters this wouldn't be an issue, yes?
> > >
> > > Yes, that's correct.
> > >
> > > > I'm aware of the argument for only logging the first four parameters,
> > > > but I've always thought it was a rather foolish decision.  Perhaps now
> > > > is the time to spend to investigate adding those two missing
> > > > parameters to the SYSCALL record so we don't have to worry about hacky
> > > > workarounds like this (to be clear, I know this hacky workaround isn't
> > > > your fault, you are just trying to make the best of a kludgy thing
> > > > <g>).
> > >
> > > I completely agree that's the right thing to do, and I'm happy to hear
> > > that you'd be open to it.
> > >
> > > I did a quick check and there are 100+ syscalls (~18% of the total)
> > > with more than 4 arguments
> > >
> > >  --around 67 of which pass audit-relevant scalars (flags, sizes,
> > >
> > > modes) in the 5th or 6th position
> > > that are currently lost.
> > >
> > > I'll look into it. Please disregard this patch in the meantime.
> >
> > Thanks Ricardo, I think this would be a great improvement!
> >
> > I'm particularly curious to see what old/existing userspace tooling
> > will do if we add the last two syscall arguments immediately after the
> > first four.
>
> It would ignore them. During search, it grabs a0 and a1, then skips to ppid.
> In the output phase, it should also ignore them since there's no code to
> interpret them.
>
> > If we have to we can add them to the end, but if it
> > doesn't break anything it would be preferable to add them inline with
> > the other parameters.
>
> I'd also prefer inline. That's the most natural view.
>
> -Steve
>
>

Thanks Paul and Steve, I agree that inline would be better as well.

I spent the afternoon working on this and already have a working
draft. I'll do some extra tests and review it, but I believe I'll be
able to post it over the next few days.

-Ricardo