linux-kernel - fanotify issues in 2.6.34-rc6-next-20100506

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 07 May 2010 11:24:48 +0200
From:	Anders Blomdell <anders.blomdell@...trol.lth.se>
To:	Eric Paris <eparis@...isplace.org>, linux-kernel@...r.kernel.org
Subject: fanotify issues in 2.6.34-rc6-next-20100506

I have started to have a look at the fanotify system, based on information
gleaned from:

  [1] http://people.redhat.com/~eparis/fanotify/
  [2] http://lwn.net/Articles/360955/

Unfortunately there seems to be some bug in the current implemenation, since
running a patched version of the fanotify.c application found in [1]

--- fanotify.c.orig     2010-03-27 05:26:27.000000000 +0100
+++ fanotify.c  2010-05-07 10:56:38.000000000 +0200
@@ -125,7 +125,7 @@
                fan_mask |= FAN_ALL_PERM_EVENTS;

        // fanotify_init(flags, event_f_flags, priority)
-       fan_fd = fanotify_init(0, O_RDONLY | O_LARGEFILE, 0);
+       fan_fd = fanotify_init(0, 0, 0);
        if (fan_fd < 0)
                goto fail;

seems to lose/corrupt events. For instance running 'fanotify -c /dir/to/watch'
and then running the command 'cd /dir/to/watch ; touch a b c d e f g h i j k l'
 might generate (results are more or less random):

/dir/to/watch/a: pid=18584 open
/dir/to/watch/a: pid=18584 close(writable)
/dir/to/watch/b: pid=18584 open                 # 2 open events for b
/dir/to/watch/b: pid=18584 open close(writable) #
/dir/to/watch/d: pid=18584 open                 # events for c missing
/dir/to/watch/d: pid=18584 open close(writable) # 2 open events for d
/dir/to/watch/f: pid=18584 open close(writable) # events for e missing
/dir/to/watch/g: pid=18584 open close(writable)
/dir/to/watch/h: pid=18584 open close(writable)
/dir/to/watch/i: pid=18584 open close(writable)
/dir/to/watch/j: pid=18584 open
/dir/to/watch/j: pid=18584 close(writable)
/dir/to/watch/k: pid=18584 open
/dir/to/watch/k: pid=18584 open close(writable) # 2 open events for k
/dir/to/watch/l: pid=18584 close(writable)      # no open event for l

A similar program using inotify gets all events correctly.


I have also problems with the fact that the following sequence dosn't leave a
trace in the fanotify events:

  mkdir /dir/not/watched
  touch /dir/not/watched/z
  ln /dir/not/watched/z /dir/to/watch/z
  rm /dir/not/watched/z
  rmdir /dir/not/watched)

What is the rationale for not reporting link/unlink events via fanotify?

Best regards

Anders Blomdell

-- 
Anders Blomdell                  Email: anders.blomdell@...trol.lth.se
Department of Automatic Control
Lund University                  Phone:    +46 46 222 4625
P.O. Box 118                     Fax:      +46 46 138118
SE-221 00 Lund, Sweden
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/