splinter work on generic fs notification framework

Amy Griffis amy.griffis at hp.com
Mon Jul 18 15:22:55 UTC 2005


On Thu, Jul 14, 2005 at 02:49:32PM -0500, Timothy R. Chavez wrote:
> On Thursday 14 July 2005 13:50, you wrote:
> > Hi Tim,
> > 
> > On Tue, Jul 12, 2005 at 02:18:20PM -0500, Timothy R. Chavez wrote:
> > > diff --exclude=.git -Nurp audit-2.6/include/linux/watch.h audit-2.6.git-fsnotify/include/linux/watch.h
> > > --- audit-2.6/include/linux/watch.h
> > > +++ audit-2.6.git-fsnotify/include/linux/watch.h
> > > @@ -0,0 +1,57 @@
> > > +#ifndef _WATCH_H
> > > +#define _WATCH_H
> > > +
> > > +struct watch {
> > > +	atomic_t                w_count;
> > > +	struct hlist_node	w_node;		/* per-directory list         */
> > > +	struct hlist_node	w_master;	/* Master watch list          */
> > > +	struct hlist_node	w_watched;	/* Watches on inode           */
> > > +	dev_t			w_dev;		/* Superblock device          */
> > > +	__u32			w_perms;	/* Permissions filtering      */
> > > +	char			*w_name;	/* Watch beneath parent       */
> > > +	char			*w_path;	/* Insertion path             */
> > > +	char			*w_filterkey;	/* An arbitrary filtering key */
> > > +	void			(*w_func);	/* Callback function          */
> > > +};
> > 
> > Looking at this structure, I'm wondering if it is sufficient for
> > inotify.  Inotify's watches are associated with an instance of an
> > inotify device.  How were you planning to account for that? 
> 
> Hi Amy,
> 
> That structure is incomplete :( 

Any progress here?

> Inotify will account for that... there's some trickery being that
> will let systems like audit and Inotify use their own specialized
> watches, but embed the fswatch into them as that is the common
> piece.

Yes, that's one way to do it.

Do you have any updates to the design that you could post to this
list?

Thanks,
Amy




More information about the Linux-audit mailing list