On Fri, Jan 26, 2007 at 05:01:12PM -0600, Timothy R. Chavez wrote: > > Please, define "access". Consider the following sequence: > > on April 1st: > > fd = open(foo, O_RDWR); > > p = mmap(..., fd, ...); > > close(fd); > > two days later: modify area pointed to by p > > a month later: munmap(p, ...); > > > > What do you want in the log? More specifically, _when_ do you want it? > > Write out a log when the last reference to the fd is put back... whether > that's from a close or an munmap.
Sigh... One more time: there are two distinct classes of objects - opened files and opened descriptors. That's the point - by the time of munmap() there is no file descriptor at all. It's been gone for a month. Descriptor getting closed != file getting closed. If you are talking about the last reference to opened file - OK. But there won't necessary be any descriptors refering to it. -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
