Re: close(2) not being audited?
On Fri, Jan 26, 2007 at 05:01:12PM -0600, Timothy R. Chavez wrote:
> What do you want in the log? More specifically, _when_ do you
want it?
Write out a log when the last reference to the fd is put back... whether
that's from a close or an munmap.
BTW... Consider the following: threads A and B share descriptor table.
Their stdin is a terminal.
Apr 1: thread A calls read(0, buf, 512);
Apr 2: thread B does close(0);
May 1: user hits enter
After Apr 2 we'll have descriptor 0 closed. Thread A is still sitting in
read() and it couldn't care less about descriptors. The file is still
opened, even though all descriptors are gone.
On May 1 read() in thread A finally completes. Upon exit from read()
we give up a reference to file, so it finally gets closed.
IOW, you'll get "it's been closed by read(2)" in logs. The same
may apply to any system call doing file IO. So userland would better
not assume that something recognizable is doing that...