| commit | b5fed474b98332559f2590c6bc90388a0899e793 | |
| author | Jan Kara <jack@suse.cz> | |
| Tue, 15 Aug 2017 11:00:37 +0000 (15 13:00 +0200) | ||
| committer | Paul Moore <paul@paul-moore.com> | |
| Tue, 15 Aug 2017 20:03:00 +0000 (15 16:03 -0400) | ||
| tree | 4f7cd528a01280492744ff415ba745f62a02ecfc | treesnapshot (tar.gz zip) |
| parent | d76036ab47eafa6ce52b69482e91ca3ba337d6d6 | commitdiff |
audit: Receive unmount event
Although audit_watch_handle_event() can handle FS_UNMOUNT event, it is
not part of AUDIT_FS_WATCH mask and thus such event never gets to
audit_watch_handle_event(). Thus fsnotify marks are deleted by fsnotify
subsystem on unmount without audit being notified about that which leads
to a strange state of existing audit rules with dead fsnotify marks.
Add FS_UNMOUNT to the mask of events to be received so that audit can
clean up its state accordingly.
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Although audit_watch_handle_event() can handle FS_UNMOUNT event, it is
not part of AUDIT_FS_WATCH mask and thus such event never gets to
audit_watch_handle_event(). Thus fsnotify marks are deleted by fsnotify
subsystem on unmount without audit being notified about that which leads
to a strange state of existing audit rules with dead fsnotify marks.
Add FS_UNMOUNT to the mask of events to be received so that audit can
clean up its state accordingly.
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Paul Moore <paul@paul-moore.com>
| kernel/audit_watch.c | diffblobblamehistory |