Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753880AbdCOOTQ (ORCPT ); Wed, 15 Mar 2017 10:19:16 -0400 Received: from helmsgagent01.f-secure.com ([193.110.108.21]:39612 "EHLO helmsgagent01.f-secure.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753293AbdCOOSJ (ORCPT ); Wed, 15 Mar 2017 10:18:09 -0400 From: Marko Rauhamaa To: Jan Kara CC: Filip =?utf-8?B?xaB0xJtkcm9uc2vDvQ==?= , "Amir Goldstein" , linux-fsdevel , linux-kernel , Alexander Viro Subject: Re: [RFC 2/2] fanotify: emit FAN_MODIFY_DIR on filesystem changes References: <20170314145801.qbiybrfpnaff2xmc@rgvaio> <871stzc5p3.fsf@drapion.f-secure.com> <20170315133952.GH12989@quack2.suse.cz> Date: Wed, 15 Mar 2017 16:18:03 +0200 In-Reply-To: <20170315133952.GH12989@quack2.suse.cz> (Jan Kara's message of "Wed, 15 Mar 2017 14:39:52 +0100") Message-ID: <87k27q4o9w.fsf@drapion.f-secure.com> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/25.1 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 894 Lines: 26 Jan Kara : > On Wed 15-03-17 10:19:52, Marko Rauhamaa wrote: >> As for "who (user/process/...) did what", the fanotify API is flawed >> in that we don't have a CLOSE_WRITE_PERM event. The hit-and-run >> process is long gone by the time we receive the event. That's more of >> a rule than an exception. > > Adding CLOSE_WRITE_PERM would not be that difficult I assume. What do you > need it for? Mainly to hold the process hostage until I have verified the content change. If I disqualify the content change, I will need to report on the process. CLOSE_WRITE only gives me a pid that is often stale as it doesn't block the process. (Another possibility would be to keep the process around as a zombie as long as the CLOSE_WRITE event's file descriptor is open. That sounds more complicated and questionable, though.) Marko -- +358 44 990 4795 Skype: marko.rauhamaa_f-secure