fstype: allow filtering of all supported file systems#520
fstype: allow filtering of all supported file systems#520rmetrich wants to merge 1 commit intolinux-audit:masterfrom
Conversation
Signed-off-by: Renaud Métrich <rmetrich@redhat.com>
|
Out of curiosity, why would we want to support all filesystems? The whole reason this exists at all is because debugfs and tracefs are pseudo filesystem that if they are watched (even accidentally) can hang the system or make it unresponsive like it has a heavy load. IOW, this was to enable the system to function normally. Opening this up to all file systems sounds like an easy way to shoot yourself in the foot. |
|
We want actually to also be able to avoid monitoring cgroup (/sys/fs/cgroup): when having CIS rules, a lot of hits show up because of systemd manipulating the cgroup hierarchy (on session creation/deletion for example). |
The code was only supporting debugfs and tracefs and the values were hardcoded.
This commit brings to for filtering all known file systems.
Credits for the shell script generator go to Sergio Correia.