Re: path-based filesystem watch limitation

On Tuesday 16 August 2005 11:52, Amy Griffis wrote: > Hello, > > I've been taking a look at the auditfs code in U2, and I've noticed an > issue with the path-based watching. In U2, the path-based watching > code only keeps tabs on the parent of given user watch, instead of > watching the entire path back to the filesystem root. > > This means that if a path component beyond the user watch's parent > changes, the recreation of the object at the watched path will not be > caught. Any subsequent events on the object at the watched path will > also not be caught. > > For example: > > # auditctl -w /one/two/three/four > # mkdir -p /one/two/three > # :> /one/two/three/four > # echo "hello world" > /one/two/three/four > > <audit records generated> > > # mv /one/two /one/too > # mkdir -p /one/two/three > # :> /one/two/three/four > # echo "hello world" > /one/two/three/four > > <no audit records generated> > > Is this a known limitation? It is known. In a CAPP environment, this sort of trickery will not come up. To do what you want to do, the logic would get extremely complicated and perhaps one day it'll be doable (upstream). Because we're storing the information _in_ the file system we're limited on how much state we can keep. The original way we had planned on doing the logic was frowned upon because it required a persisent (and potentially sizeable) map of a file system depicting where all the watched locations are (and I believe there were some namespace issues as well). This way each component of the watched path in the actual file system could be mapped all the way up to the root directory.

-tim > > Amy > > -- > Linux-audit mailing list > Linux-audit(a)redhat.com > http://www.redhat.com/mailman/listinfo/linux-audit > > -- Linux-audit mailing list Linux-audit(a)redhat.com http://www.redhat.com/mailman/listinfo/linux-audit