Re: close(2) not being audited?
On Fri, Jan 26, 2007 at 05:01:12PM -0600, Timothy R. Chavez wrote:
> Please, define "access". Consider the following
sequence:
> on April 1st:
> fd = open(foo, O_RDWR);
> p = mmap(..., fd, ...);
> close(fd);
> two days later: modify area pointed to by p
> a month later: munmap(p, ...);
>
> What do you want in the log? More specifically, _when_ do you want it?
Write out a log when the last reference to the fd is put back... whether
that's from a close or an munmap.
Sigh... One more time: there are two distinct classes of objects - opened
files and opened descriptors. That's the point - by the time of munmap()
there is no file descriptor at all. It's been gone for a month.
Descriptor getting closed != file getting closed. If you are talking about
the last reference to opened file - OK. But there won't necessary be
any descriptors refering to it.