linux-kernel - inotify: notify IN_DELETE_SELF when file is deleted or inode deleted ?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 29 Jun 2012 16:06:04 +0200
From:	Pierre PEIFFER <pierre.peiffer@...ricsson.com>
To:	<linux-kernel@...r.kernel.org>
Subject: inotify: notify IN_DELETE_SELF when file is deleted or inode deleted
 ?

Hi,

By playing with inotify (on user side) to know whether the file I'm 
using is deleted by someone else,  I have noted that I do not receive 
the IN_DELETE_SELF event, exactly because I'm using it. By checking into 
kernel area, I see that at unlink(), an IN_ATTRIB event is sent, but 
IN_DELETE_SELF is, indeed, sent only when the inode is deleted.

But such IN_ATTRIB event doesn't tell to the user what has changed among 
permissions, timestamps, link count, etc...
So it doesn't much help. Of course, I have noted that I can monitor the 
parent directory for IN_DELETE and then check which file has been 
deleted; few more stuff to do but it works, no pb.

But I'm still wondering after reading in the man.:
            IN_DELETE_SELF    Watched file/directory was itself deleted.
Is this really the expected behavior ? Shouldn't the kernel trig such 
event at unlink() ? Or is inotify clearly inode oriented ?

Thanks,

Pierre

PS: keep me in cc, I'm not subscribed to the list.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/