Received-SPF: pass (google.com: domain of linux-ext4-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   bugzilla-daemon@kernel.org
To:     linux-ext4@vger.kernel.org
Subject: [Bug 216775] New: fanotify reports parent PPID insted of PID for
 FAN_MODIFY events
Date:   Mon, 05 Dec 2022 04:38:02 +0000
Message-ID: <bug-216775-13602@https.bugzilla.kernel.org/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Auto-Submitted: auto-generated
MIME-Version: 1.0
Precedence: bulk

https://bugzilla.kernel.org/show_bug.cgi?id=3D216775

            Bug ID: 216775
           Summary: fanotify reports parent PPID insted of PID for
                    FAN_MODIFY events
           Product: File System
           Version: 2.5
    Kernel Version: 5.15.0
          Hardware: Intel
                OS: Linux
              Tree: Mainline
            Status: NEW
          Severity: normal
          Priority: P1
         Component: ext4
          Assignee: fs_ext4@kernel-bugs.osdl.org
          Reporter: saikiran.gummaraj@icloud.com
        Regression: No

Hello,

While I've been developing a library around fanotify in Go, I noticed that
fanotify subsystem reports the parent process ID in fanotify_event_metadata=
.pid
instead of the Process ID when mask is set to FAN_MODIFY. I was able to con=
firm
the error through a test and also manually verifying the PIDs in the audit =
log.
I did not observe this behaviour for FAN_ACCESS bit.

I've been able to reproduce this on -

Ubuntu 20.04.5 - 5.15.0-53-generic
Ubuntu 22.10 - 5.19.0-23-generic

It can be reproduced by -

git clone git@github.com:opcoder0/fanotify.git
cd fanotify
sudo go test -v

The test "TestWithCapSysAdmFanotifyFileModified" fails reporting pid mismat=
ch.

--=20
You may reply to this email to add a comment.

You are receiving this mail because:
You are watching the assignee of the bug.=