Re: [RFC PATCH ghak100 V1 1/2] audit: avoid fcaps on MNT_FORCE
On Mon, Nov 19, 2018 at 11:59 PM Richard Guy Briggs <rgb(a)redhat.com> wrote:
The simple answer is that the audit PATH record format expects the
four
cap_f* fields to be there and a best effort is being attempted to fill
in that information in an expected way with meaningful values. Perhaps
better to accept that it is unreasonable to expect any fcaps on any
umount operation and simply ignore those fields in the PATH record for
umount syscall events.
When there's a mount there are in fact two objects belonging to the
exact same path, each having completely independent metadata: the
mount point and the root of the mount. For example:
stat /mnt
umount /mnt
stat /mnt
The first stat will show the root of the mount, the second one will
show the mount point.
Which one is the relevant for audit?
Not saying audit should be doing getxattr on any of them, just trying
to see more clearly.
Thanks,
Miklos