linux-kernel - Re: inotify, new idea?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 26 May 2014 02:46:52 +0300
From:	Marian Marinov <mm@...com>
To:	Richard Weinberger <richard@....at>,
	"Michael Kerrisk (man-pages)" <mtk.manpages@...il.com>
CC:	Lennart Sorensen <lsorense@...lub.uwaterloo.ca>,
	Jos Huisken <jos.huisken@...il.com>,
	Linux Kernel <linux-kernel@...r.kernel.org>
Subject: Re: inotify, new idea?

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 05/24/2014 03:34 PM, Richard Weinberger wrote:
> Am 24.05.2014 09:52, schrieb Michael Kerrisk (man-pages):
>> On 04/21/2014 10:42 AM, Richard Weinberger wrote:
>>> Am 21.04.2014 09:24, schrieb Michael Kerrisk:
>>>>> Does recursive monitoring even work with inotify? Last time I've tried it did failed as soon I did a mkdir
>>>>> -p a/b/c/d because mkdir() raced against the thread which installes the new watches.
>>>> 
>>>> As I understand it, you have to program to deal with the races (rescan directories after adding watches). I
>>>> recently did a lot of work updating the inotify(7) man page to discuss all the issues that I know of, and
>>>> their remedies. If I missed anything, I'd appreciate a note on it, so that it can be added. See 
>>>> http://man7.org/linux/man-pages/man7/inotify.7.html#NOTES
>>> 
>>> I'm aware of the rescan hack, but in my case it does not help because my program must not miss any event. 
>>> Currently I'm using a fuse overlay filesystem to log everything. Not perfect but works... :-)
>> 
>> Richard,
>> 
>> A late follow up question. How does your application deal with the event overflow problem (i.e., when you get a
>> large number of events much faster than your application can deal with them?
> 
> The downside of the FUSE approach is that you have to intercept every filesystem function. This can be a
> performance issue. But due to this design the overflow problem cannot happen as the FUSE filesystem blocks until
> the event has been proceed.
> 

Have anyone of you looked at this: https://github.com/1and1/linux-filemon/

I haven't stress tested it, but in the past I ported it to more recent kernels:
  https://github.com/hackman/filemon-patches

It is not polished, but it works.

I'm considering fixing some of the issues at has for use in my home setup.

Marian

> Thanks, //richard -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a
> message to majordomo@...r.kernel.org More majordomo info at  http://vger.kernel.org/majordomo-info.html Please read
> the FAQ at  http://www.tux.org/lkml/
> 


- -- 
Marian Marinov
Founder & CEO of 1H Ltd.
Jabber/GTalk: hackman@...ber.org
ICQ: 7556201
Mobile: +359 886 660 270
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)

iEYEARECAAYFAlOCgOwACgkQ4mt9JeIbjJSXrgCdHCFADxvKN3Hxb4qinc/5Fj6V
WYMAnArk3Zb8YqTUNoyNCh1zYplUUx9B
=y/Sm
-----END PGP SIGNATURE-----
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/