linux-kernel - inotify limits - thousands (tens of thousands?) of watches

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 20 May 2009 11:26:57 +0200
From:	Marcin Krol <mrkafk@...il.com>
To:	linux-kernel@...r.kernel.org
Subject: inotify limits - thousands (tens of thousands?) of watches

Hello everyone,

First, apols for using up bandwidth, but I honestly found no other place 
where I can ask about this (and get meaningful reply).

I'm not a kernel programmer, but I want to develop a program that would 
watch modifications in *all* user directories on a busy server using 
inotify.

This is for high-availability purposes - events would be collected and 
once every several minutes changed dirs would be rsync'ed to failover 
server or smth like that would be done.

As inotify watches particular directory and not its subdirs, I would 
have to watch all directories.

This means I would have to create thousands or even tens of thousands of 
inotify watches.

So my questions are:

1. is it safe? that is, will it not lock the kernel up, or cause 
excessive memory consumption?

2. is it economic in terms of CPU time and RAM? I have no idea how to 
even measure such a thing happening in the kernel..




Here's first test take on inotify watch (runs on Debian):

######################### cut ################################

#include "stdio.h"
#include "stdlib.h"
#include "errno.h"
#include <linux/types.h>
#include <linux/inotify.h>
#include <sys/syscall.h>

#define EVENT_SIZE  ( sizeof (struct inotify_event) )
#define BUF_LEN     ( 1024 * ( EVENT_SIZE + 16 ) )


static inline int inotify_init (void)
{
         return syscall (__NR_inotify_init);
}

static inline int inotify_add_watch (int fd, const char *name, __u32 mask)
{
         return syscall (__NR_inotify_add_watch, fd, name, mask);
}

static inline int inotify_rm_watch (int fd, __u32 wd)
{
         return syscall (__NR_inotify_rm_watch, fd, wd);
}


int main( int argc, char **argv )
{
   int length, i = 0;
   int fd;
   int wd;
   char buffer[BUF_LEN];

   fd = inotify_init();

   if ( fd < 0 ) {
     perror( "inotify_init" );
   }

   wd = inotify_add_watch( fd, argv[1], IN_ALL_EVENTS );
   length = read( fd, buffer, BUF_LEN );

   if ( length < 0 ) {
     perror( "read" );
   }

   while ( i < length ) {
     struct inotify_event *event = ( struct inotify_event * ) &buffer[ i ];
     if ( event->len ) {
       if ( event->mask & IN_CREATE ) {
         if ( event->mask & IN_ISDIR ) {
           printf( "The directory %s was created.\n", event->name );
         }
         else {
           printf( "The file %s was created.\n", event->name );
         }
       }
       else if ( event->mask & IN_DELETE ) {
         if ( event->mask & IN_ISDIR ) {
           printf( "The directory %s was deleted.\n", event->name );
         }
         else {
           printf( "The file %s was deleted.\n", event->name );
         }
       }
       else if ( event->mask & IN_MODIFY ) {
         if ( event->mask & IN_ISDIR ) {
           printf( "The directory %s was modified.\n", event->name );
         }
         else {
           printf( "The file %s was modified.\n", event->name );
         }
       }
       else if ( event->mask & IN_ALL_EVENTS ) {
           printf("Some other event on %s, mask %x.\n", event->name, 
event->mask);
       }
     }
     i += EVENT_SIZE + event->len;
   }

   ( void ) inotify_rm_watch( fd, wd );
   ( void ) close( fd );

   exit( 0 );
}

######################### cut ################################

Regards,
mk
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/