VFS hooks analysis (pass 1)
Chris Wright
chrisw at osdl.org
Mon Aug 29 21:36:35 UTC 2005
* Amy Griffis (amy.griffis at hp.com) wrote:
> On Fri, Aug 26, 2005 at 06:13:41PM -0400, Amy Griffis wrote:
> > Attribute Changes:
> >
> > The getname/path_lookup hooks are never called for these syscalls:
> >
> > sys_fchmod
> > sys_fchown
> > sys_fremovexattr
> > sys_fsetxattr
> >
> > The fsnotify_change() and fsnotify_xattr() hooks capture the relevant
> > dentry, so the dentry's name & inode could be passed to the event
> > callback.
>
> Looking again, I don't see a call to fsnotify_xattr() in the path for
> removing xattrs. So that is something we'd need to request.
It's already in -mm, looks like it just missed 2.6.13.
More information about the Linux-audit
mailing list