[PATCH 10/10] audit: Replace chunk attached to mark instead of replacing mark

Amir Goldstein amir73il at gmail.com
Wed Jul 11 14:17:01 UTC 2018


On Tue, Jul 10, 2018 at 1:02 PM, Jan Kara <jack at suse.cz> wrote:
> Audit tree code currently associates new fsnotify mark with each new
> chunk. As chunk attached to an inode is replaced when new tag is added /
> removed, we also need to remove old fsnotify mark and add a new one on
> such occasion.  This is cumbersome and makes locking rules somewhat
> difficult to follow.
>
> Fix these problems by allocating fsnotify mark independently of chunk
> and keeping it all the time while there is some chunk attached to an
> inode. Also add documentation about the locking rules so that things are
> easier to follow.
>
> Signed-off-by: Jan Kara <jack at suse.cz>
> ---

Well, if there are bugs here I can't find them, but they sure have a lot of
places to hide...

Cheers,
Amir.




More information about the Linux-audit mailing list