VFS hooks analysis (pass 1)

Amy Griffis amy.griffis at hp.com
Mon Aug 29 21:03:14 UTC 2005


On Fri, Aug 26, 2005 at 06:13:41PM -0400, Amy Griffis wrote:
> Attribute Changes:
> 
> The getname/path_lookup hooks are never called for these syscalls:
> 
>     sys_fchmod
>     sys_fchown
>     sys_fremovexattr
>     sys_fsetxattr
> 
> The fsnotify_change() and fsnotify_xattr() hooks capture the relevant
> dentry, so the dentry's name & inode could be passed to the event
> callback.

Looking again, I don't see a call to fsnotify_xattr() in the path for
removing xattrs.  So that is something we'd need to request.




More information about the Linux-audit mailing list