lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date:   Mon, 05 Dec 2022 04:38:02 +0000
From:   bugzilla-daemon@...nel.org
To:     linux-ext4@...r.kernel.org
Subject: [Bug 216775] New: fanotify reports parent PPID insted of PID for
 FAN_MODIFY events

https://bugzilla.kernel.org/show_bug.cgi?id=216775

            Bug ID: 216775
           Summary: fanotify reports parent PPID insted of PID for
                    FAN_MODIFY events
           Product: File System
           Version: 2.5
    Kernel Version: 5.15.0
          Hardware: Intel
                OS: Linux
              Tree: Mainline
            Status: NEW
          Severity: normal
          Priority: P1
         Component: ext4
          Assignee: fs_ext4@...nel-bugs.osdl.org
          Reporter: saikiran.gummaraj@...oud.com
        Regression: No

Hello,

While I've been developing a library around fanotify in Go, I noticed that
fanotify subsystem reports the parent process ID in fanotify_event_metadata.pid
instead of the Process ID when mask is set to FAN_MODIFY. I was able to confirm
the error through a test and also manually verifying the PIDs in the audit log.
I did not observe this behaviour for FAN_ACCESS bit.

I've been able to reproduce this on -

Ubuntu 20.04.5 - 5.15.0-53-generic
Ubuntu 22.10 - 5.19.0-23-generic

It can be reproduced by -

git clone git@...hub.com:opcoder0/fanotify.git
cd fanotify
sudo go test -v

The test "TestWithCapSysAdmFanotifyFileModified" fails reporting pid mismatch.

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are watching the assignee of the bug.

Powered by blists - more mailing lists