Re: [PATCH 1/1] audit: Add new syscalls to the perm=w filter

On Thu, Oct 12, 2017 at 11:24 PM, Steve Grubb <sgrubb(a)redhat.com&gt; wrote: > The audit subsystem allows selecting audit events based on watches for > a particular behavior like writing to a file. A lot of syscalls have > been added without updating the list. This patch adds 2 syscalls to the > write filters: fallocate and renameat2. > > Signed-off-by: sgrubb <sgrubb(a)redhat.com&gt; > --- > include/asm-generic/audit_dir_write.h | 4 ++++ > include/asm-generic/audit_write.h | 3 +++ > 2 files changed, 7 insertions(+) FWIW, I expect that this syscall list is almost always going to be out of date; it's just the way this feature is designed. That doesn't mean I'm not going to merge fixes, I just want to make sure expectations are set accordingly. Before I merge this Steve, can you explain why fallocate() should be on the write list? It doesn't actually write any user data to disk, it actually doesn't write anything, all it does is play with the amount of space allocated for the given fd on the storage device. I don't really care either way, this just struck me as odd and I want to make sure you have a good reason (hint: add it to the patch description).