On Wednesday, January 21, 2015 04:36:38 AM Al Viro wrote:
Another thing I really do not understand is
+ if (inode->i_ino) {
+ /* valid inode number, use that for the ...
+ if (n->ino != inode->i_ino ||
+ n->dev != inode->i_sb->s_dev)
+ continue;
in __audit_inode(). We don't *have* dentries with dentry->d_inode->i_ino ==
0. Ever. WTF is that about? Paul?
Likely stupidity on my part. It looks like a typo, that first if conditional
should check "n->ino" instead of "inode->i_ino"; in
__audit_getname() we
record names without any inode numbers, so we need to see if this is one of
those records. Interesting that it passed my testing; either my testing is
crap (always a strong possibility) or something else came to the rescue. I'm
still coming up to speed on the audit/VFS code ...
I'll fix that up and include in the next patchset once we resolve this issue.
--
paul moore
security @ redhat