Re: peculiar disappearance of most audit rules
On 14/04/27, Peter Grandi wrote:
> but in either case, the inodes aren't supposed to be able
to
> be kicked out of core...
But on 3 different system I have they really seem to be evicted,
and with regularity, and this does not happen if the inodes are
kept open.
From the source I have looked at, the *notify code seems to
attempt to hold on to the inodes that are watched, but perhaps
it has some hidden assumptions that the 'audit' module does not
satisfy.
Do you have a reproducer to detect this quickly?
Miklos Szeredi appears to have found the likely cause:
https://lkml.org/lkml/2014/11/4/246
- RGB
--
Richard Guy Briggs <rbriggs(a)redhat.com>
Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, Red Hat
Remote, Ottawa, Canada
Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545