VFS hooks analysis (pass 1)

Amy Griffis amy.griffis at hp.com
Tue Aug 30 00:49:34 UTC 2005


On Mon, Aug 29, 2005 at 02:36:35PM -0700, Chris Wright wrote:
> * Amy Griffis (amy.griffis at hp.com) wrote:
> > On Fri, Aug 26, 2005 at 06:13:41PM -0400, Amy Griffis wrote:
> > > Attribute Changes:
> > > 
> > > The getname/path_lookup hooks are never called for these syscalls:
> > > 
> > >     sys_fchmod
> > >     sys_fchown
> > >     sys_fremovexattr
> > >     sys_fsetxattr
> > > 
> > > The fsnotify_change() and fsnotify_xattr() hooks capture the relevant
> > > dentry, so the dentry's name & inode could be passed to the event
> > > callback.
> > 
> > Looking again, I don't see a call to fsnotify_xattr() in the path for
> > removing xattrs.  So that is something we'd need to request.
> 
> It's already in -mm, looks like it just missed 2.6.13.

Great, thanks for the update.




More information about the Linux-audit mailing list