[redhat-lspp] Re: inotify_rm_watch behavior

[Amy Griffis]

Eduardo Madeira Fleury wrote:  [Mon Sep 11 2006, 02:05:24PM EDT]
> I'm doing some tests and currently inotify_rm_watch is not performing any 
> permission checks, i.e., an ordinary user can remove a watch set by root on a 
> file with root:root 400 permission.
> 
> Is this the expected behavior? Seems like neither MAC nor MLS checks are being 
> done.

Yes.  As I understand it, an inotify watch is not a data object, and
so does not require DAC or MAC checks.

Amy