close(2) not being audited?
Timothy R. Chavez
tinytim at us.ibm.com
Fri Jan 26 23:46:25 UTC 2007
On Fri, 26 Jan 2007 18:20:51 -0500
Alexander Viro <aviro at redhat.com> wrote:
> On Fri, Jan 26, 2007 at 05:01:12PM -0600, Timothy R. Chavez wrote:
> > > Please, define "access". Consider the following sequence:
> > > on April 1st:
> > > fd = open(foo, O_RDWR);
> > > p = mmap(..., fd, ...);
> > > close(fd);
> > > two days later: modify area pointed to by p
> > > a month later: munmap(p, ...);
> > >
> > > What do you want in the log? More specifically, _when_ do you want it?
> >
> > Write out a log when the last reference to the fd is put back... whether
> > that's from a close or an munmap.
>
> Sigh... One more time: there are two distinct classes of objects - opened
> files and opened descriptors. That's the point - by the time of munmap()
> there is no file descriptor at all. It's been gone for a month.
>
> Descriptor getting closed != file getting closed. If you are talking about
> the last reference to opened file - OK. But there won't necessary be
> any descriptors refering to it.
Yep, I was referring to last reference to opened file.
I'd hate to suggest adding a field to the file like "opened_as" which would
store the original fd it was assigned, but that would be enough to associate
the open() record and the final "close" record.
-tim
PS: Ugh, at this list for being write-protected :).
More information about the Linux-audit
mailing list