linux-kernel - Re: [PATCH] fs: don't remove inotify watchers from alive inode-s

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 9 Sep 2014 10:54:39 +0200
From:	Jan Kara <jack@...e.cz>
To:	Al Viro <viro@...IV.linux.org.uk>
Cc:	Andrey Vagin <avagin@...nvz.org>, linux-fsdevel@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	John McCutchan <john@...nmccutchan.com>,
	Robert Love <rlove@...ve.org>,
	Eric Paris <eparis@...isplace.org>,
	Cyrill Gorcunov <gorcunov@...nvz.org>,
	Pavel Emelyanov <xemul@...allels.com>
Subject: Re: [PATCH] fs: don't remove inotify watchers from alive inode-s

On Tue 09-09-14 02:27:12, Al Viro wrote:
> On Mon, Sep 08, 2014 at 04:01:56PM +0400, Andrey Vagin wrote:
> > Currently watchers are removed in dentry_iput(), if n_link is zero.
> > But other detries can be linked with this inode. For example if we
> > create two hard links, open the first one and set a watcher on the
> > second one. Then if we remove both links, the watcher will be removed.
> > But we will have the alive file descriptor, which allows us to generate
> > more events.
> > 
> > With this patch, watchers will be removed, only if nlink is zero and
> > i_dentry list is empty.
> 
> It changes user-visible ABI.  Worse yet, this "ABI" has no specification,
> so any (misguided) software using that FPOS has nothing to go by other than
> "whatever existing kernels do".  As the result, inotify behaviour is cast
> in concrete.
  I agree that it changes user-visible ABI and I agree the behavior isn't
really specified in the manpage. However our position has always been you can
change stuff unless someone complains. In this case the current behavior
is: If you just unlink opened file, you keep getting inotify events for that
inode. Also if you do sequence like:
        fd = inotify_init1(IN_NONBLOCK);
        deleted = open(path, O_CREAT | O_TRUNC | O_WRONLY, 0666);
        link(path, path_link);
        wd_deleted = inotify_add_watch(fd, path_link, IN_ALL_EVENTS);

        unlink(path_link);
        unlink(path);

You will also keep getting inotify events for that inode (the first unlink
will naturally just generate ATTRIB event, the second unlink will fail the
test:
	if (dentry->d_lockref.count == 1) {
in d_delete() and thus won't call dentry_unlink_inode() which would delete
inotify watch.

However if you do sequence like:
        fd = inotify_init1(IN_NONBLOCK);
        deleted = open(path, O_CREAT | O_TRUNC | O_WRONLY, 0666);
        link(path, path_link);
        wd_deleted = inotify_add_watch(fd, path_link, IN_ALL_EVENTS);

        unlink(path);	/* Note swapped unlink order */
        unlink(path_link);

You will stop getting inotify events for the inode.

That's so stupid and inconsistent (plus the behavior of this already
changed in the past as my tests with older kernels show) that I'm convinced
noone really depends on this. So I'm for fixing the bug even though it has
userspace visible impact.

								Honza
-- 
Jan Kara <jack@...e.cz>
SUSE Labs, CR
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/