On Wednesday, January 21, 2015 04:36:38 AM Al Viro wrote:
> Another thing I really do not understand is
> + if (inode->i_ino) {
> + /* valid inode number, use that for the ...
> + if (n->ino != inode->i_ino ||
> + n->dev != inode->i_sb->s_dev)
> + continue;
> in __audit_inode(). We don't *have* dentries with dentry->d_inode->i_ino ==
> 0. Ever. WTF is that about? Paul?
Likely stupidity on my part. It looks like a typo, that first if conditional
should check "n->ino" instead of "inode->i_ino"; in __audit_getname() we
record names without any inode numbers, so we need to see if this is one of
those records. Interesting that it passed my testing; either my testing is
crap (always a strong possibility) or something else came to the rescue. I'm
still coming up to speed on the audit/VFS code ...
I'll fix that up and include in the next patchset once we resolve this issue.
--
paul moore
security @ redhat
--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit
