linux-kernel - Re: A possible flaw in the fsnotify design.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 15 Nov 2010 18:12:34 -0500
From:	Eric Paris <eparis@...hat.com>
To:	Alexey Zaytsev <alexey.zaytsev@...il.com>
Cc:	Tvrtko Ursulin <tvrtko.ursulin@...hos.com>,
	linux-fsdevel@...r.kernel.org,
	"stefan@...ttcher.org" <stefan@...ttcher.org>,
	linux-kernel@...r.kernel.org, Al Viro <viro@...iv.linux.org.uk>,
	agruen@...bit.com
Subject: Re: A possible flaw in the fsnotify design.

On Tue, 2010-11-16 at 02:03 +0300, Alexey Zaytsev wrote:
> On Tue, Nov 16, 2010 at 01:51, Eric Paris <eparis@...hat.com> wrote:
> > On Tue, 2010-11-16 at 01:44 +0300, Alexey Zaytsev wrote:
> >> On Tue, Nov 16, 2010 at 01:11, Eric Paris <eparis@...hat.com> wrote:
> >> > On Tue, 2010-11-16 at 01:05 +0300, Alexey Zaytsev wrote:
> >> >> Just some thoughts.
> >> >>
> >> >> Consider the situation: Files A and B both point to the same inode.
> >> >> File A is being watched, but the user won't get notifications if B is
> >> >> modified.
> >> >
> >> > That's not true.  Users watch inodes, not files (this is true for both
> >> > inotify and fanotify).  Give it a try, it works.
> >> >
> >>
> >> debian-i386:~/tmp# touch a
> >> debian-i386:~/tmp# ../fanotify a &
> >> debian-i386:~/tmp# link a b
> >> debian-i386:~/tmp# ls -li
> >> total 0
> >> 3433 -rw-r--r-- 2 root root 0 Nov 15 22:37 a
> >> 3433 -rw-r--r-- 2 root root 0 Nov 15 22:37 b
> >> debian-i386:~/tmp# echo 123 > b
> >> /root/tmp/b: pid=2143 mask = 20 open
> >> /root/tmp/b: pid=2143 mask = a modify 0 - 4 close(writable)  0 - 4
> >>
> >> Am I doing something wrong? Same thing happens if I watch the mount point.
> >
> > Maybe I don't understand the problem, you watched the inode behind A.
> > You made changes accessing this inode via B, you got notification about
> > those changes.  Isn't that what you wanted?
> 
> I'd expect to get two notifications in this case. Might not be a
> problem when you are watching individual files, but there is no clear
> way to get all the modified files, if you are watching a mount point.

Ah, you were hoping for 4 events.  Yeah, not possible.  You get notified
when the inode changes, which way you get notified is up to the kernel
and we leave it as an (impossible) exercise to userspace to map hard
linked inodes back together   :)


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/