linux-kernel - Re: [PATCH] inotify: Added pid and uid information in inotify event.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAOQ4uxg72R6Ho2f-HDyc7DsPBvw=8pkgSuGkwC17oNeKTu=_UA@mail.gmail.com>
Date: Mon, 8 Jul 2024 19:29:39 +0300
From: Amir Goldstein <amir73il@...il.com>
To: lizhigang <lizhigang.1220@...edance.com>
Cc: jack@...e.cz, linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] inotify: Added pid and uid information in inotify event.

On Mon, Jul 8, 2024 at 1:13 PM lizhigang <lizhigang.1220@...edance.com> wrote:
>
> The inotify event only contains file name information. Sometimes we
> also want to know user or process information,such as who created
> or deleted a file. This patch adds information such as COMM, PID
> and UID to the end of filename, which allowing us to implement
> this function without modifying the current Inotify mechanism.
>
> This function is not enabled by default and is enabled through an IOCTL
>
> When enable this function, inotify_event->name will contain comm,
> pid and uid information, with the following specific format:
>
> filename____XXX,pid:YYY__uid:ZZZ
>
> Pseudo code to enable this function:
> int rc, bytes_to_read, inotify_fd;
>
> inotify_fd = inotify_init();
> ...
> // enable padding uid,pid information
> rc = ioctl( inotify_fd, TIOCLINUX, &bytes_to_read);
>
> Log example with this function:
> CREATE,ISDIR /home/peter/testdir____mkdir,pid:3626__uid:1000
> CREATE /home/peter/test.txt____bash,pid:3582__uid:1000
> OPEN /home/peter/test.txt____bash,pid:3582__uid:1000
> MODIFY /home/peter/test.txt____bash,pid:3582__uid:1000
> CLOSE_WRITE,CLOSE /home/peter/test.txt____bash,pid:3582__uid:1000
> OPEN,ISDIR /home/peter/testdir____rm,pid:3640__uid:1000
> ACCESS,ISDIR /home/peter/testdir____rm,pid:3640__uid:1000
> ACCESS,ISDIR /home/peter/testdir____rm,pid:3640__uid:1000
> CLOSE_NOWRITE,CLOSE,ISDIR /home/peter/testdir____rm,pid:3640__uid:1000
> DELETE,ISDIR /home/peter/testdir____rm,pid:3640__uid:1000
>

Please take a look at https://man7.org/linux/man-pages/man7/fanotify.7.html

It already reports pid and the event format already supports info extensions,
so adding uid would be easy (opt-in not via ioctl but via
fanotify_init() flags),
if you can justify the use case for this feature.

There are still some differences between inotify and fanotify that
could make people want to use inotify, but generally, I would not like
to extend inotify API like this.

Thanks,
Amir.