Re: [PATCH] audit_tree: keep inode pinned
- First Post
- Replies
- Stats
-
Go to
- ----- 2024 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2023 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2022 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2021 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2020 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2019 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2018 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2017 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2016 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2015 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2014 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2013 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2012 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2011 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2010 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2009 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2008 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2007 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2006 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2005 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2004 -----
- December
- November
- October
- September
- August
On 14/11/04, Miklos Szeredi wrote:
From: Miklos Szeredi <mszeredi(a)suse.cz>
Hi Miklos,
Audit rules disappear when an inode they watch is evicted from the
cache.
This is likely not what we want.
The guilty commit is "fsnotify: allow marks to not pin inodes in core",
which didn't take into account that audit_tree adds watches with a zero
mask.
Adding any mask should fix this.
Nice find! Do you have a quick reproducer to detect this?
Fixes: 90b1e7a57880 ("fsnotify: allow marks to not pin inodes in
core")
Signed-off-by: Miklos Szeredi <mszeredi(a)suse.cz>
Cc: stable(a)vger.kernel.org # 2.6.36+
---
kernel/audit_tree.c | 1 +
1 file changed, 1 insertion(+)
--- a/kernel/audit_tree.c
+++ b/kernel/audit_tree.c
@@ -154,6 +154,7 @@ static struct audit_chunk *alloc_chunk(i
chunk->owners[i].index = i;
}
fsnotify_init_mark(&chunk->mark, audit_tree_destroy_watch);
+ chunk->mark.mask = FS_IN_IGNORED;
return chunk;
}
- RGB
--
Richard Guy Briggs <rbriggs(a)redhat.com>
Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, Red Hat
Remote, Ottawa, Canada
Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545
Miklos Szeredi
Wednesday, 5 November
Wed, 5 Nov
1:36 p.m.
New subject: [PATCH] audit_tree: keep inode pinned
On Wed, Nov 5, 2014 at 5:58 PM, Richard Guy Briggs <rgb(a)redhat.com> wrote:
On 14/11/04, Miklos Szeredi wrote:
> From: Miklos Szeredi <mszeredi(a)suse.cz>
Hi Miklos,
> Audit rules disappear when an inode they watch is evicted from the cache.
> This is likely not what we want.
>
> The guilty commit is "fsnotify: allow marks to not pin inodes in core",
> which didn't take into account that audit_tree adds watches with a zero
> mask.
>
> Adding any mask should fix this.
Nice find! Do you have a quick reproducer to detect this?
- reboot
- add tree rule
- echo 2 > /proc/sys/vm/drop_caches
drop_caches doesn't guarantee dropping the inode from the cache, but
after a reboot it usually does.
Thanks,
Miklos
Wednesday, 12 November
Wed, 12 Nov
11:30 a.m.
New subject: [PATCH] audit_tree: keep inode pinned
On 14/11/05, Miklos Szeredi wrote:
On Wed, Nov 5, 2014 at 5:58 PM, Richard Guy Briggs
<rgb(a)redhat.com> wrote:
> On 14/11/04, Miklos Szeredi wrote:
>> From: Miklos Szeredi <mszeredi(a)suse.cz>
>
> Hi Miklos,
>
>> Audit rules disappear when an inode they watch is evicted from the cache.
>> This is likely not what we want.
>>
>> The guilty commit is "fsnotify: allow marks to not pin inodes in
core",
>> which didn't take into account that audit_tree adds watches with a zero
>> mask.
>>
>> Adding any mask should fix this.
>
> Nice find! Do you have a quick reproducer to detect this?
- reboot
- add tree rule
- echo 2 > /proc/sys/vm/drop_caches
drop_caches doesn't guarantee dropping the inode from the cache, but
after a reboot it usually does.
Perfect, thanks! That works as expected. While I was at it, I checked
the audit_watch code and the pending "filter on process name" patches to
make sure they didn't have the same problem.
Thanks,
Miklos
- RGB
--
Richard Guy Briggs <rbriggs(a)redhat.com>
Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, Red Hat
Remote, Ottawa, Canada
Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545
3692
days inactive
3699
days old
linux-audit@lists.linux-audit.osci.io
2 comments
2 participants
tags (0)
participants (2)
-
Miklos Szeredi -
Richard Guy Briggs