Date: Sat, 11 Jul 2009 12:18:16 -0700
From: Sukadev Bhattiprolu <sukadev@linux.vnet.ibm.com>
To: Matt Helsley <matthltc@us.ibm.com>
Cc: Eric Paris <eparis@redhat.com>, linux-kernel@vger.kernel.org,
       malware-list@dmesg.printk.net,
       Containers <containers@lists.linux-foundation.org>
Subject: Re: fanotify: the fscking all notification system
Message-ID: <20090711191816.GA5222@us.ibm.com>
References: <1246306125.754.300.camel@dhcp235-23.rdu.redhat.com> <20090701041039.GB23013@count0.beaverton.ibm.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20090701041039.GB23013@count0.beaverton.ibm.com>
User-Agent: Mutt/1.5.18 (2008-05-17)
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 1183
Lines: 29

| > struct fanotify_event_metadata {
| >         __u32 event_len;
| >         __s32 fd;
| >         __u32 mask;
| >         __u32 f_flags;
| >         pid_t pid;
| >         pid_t tgid;
| >         __u64 cookie;
| > }  __attribute__((packed));
| 
| Since it passes pids from the kernel to userspace via a socket I suspect
| this needs input from the folks working on pid namespaces. The events may
| need to be dropped if the pid namespace of the event's origin doesn't
| match that of the destination. Otherwise the pid would be ambiguous and
| this interface will only work for tasks in the initial pid namespace.

If we do have the destination pid namespace, we could translate the pid
of the process modifying the file, into the pid namespace of the process
receiving the notification, like we do in mq_notify().

So when a process in an ancestor or unrelated pid namespace modifies the
file, the si_pid would get set to 0. 

Sukadev
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/