Revision b5fed474b98332559f2590c6bc90388a0899e793 authored by Jan Kara on 15 August 2017, 11:00:37 UTC, committed by Paul Moore on 15 August 2017, 20:03:00 UTC
Although audit_watch_handle_event() can handle FS_UNMOUNT event, it is not part of AUDIT_FS_WATCH mask and thus such event never gets to audit_watch_handle_event(). Thus fsnotify marks are deleted by fsnotify subsystem on unmount without audit being notified about that which leads to a strange state of existing audit rules with dead fsnotify marks. Add FS_UNMOUNT to the mask of events to be received so that audit can clean up its state accordingly. Signed-off-by: Jan Kara <jack@suse.cz> Signed-off-by: Paul Moore <paul@paul-moore.com>
1 parent d76036a
| File | Mode | Size |
|---|---|---|
| array_size.cocci | -rw-r--r-- | 1.7 KB |
| badty.cocci | -rw-r--r-- | 1.7 KB |
| boolconv.cocci | -rw-r--r-- | 1.4 KB |
| boolinit.cocci | -rw-r--r-- | 2.2 KB |
| boolreturn.cocci | -rw-r--r-- | 662 bytes |
| bugon.cocci | -rw-r--r-- | 1.4 KB |
| cond_no_effect.cocci | -rw-r--r-- | 2.0 KB |
| cstptr.cocci | -rw-r--r-- | 827 bytes |
| doubleinit.cocci | -rw-r--r-- | 1.4 KB |
| ifaddr.cocci | -rw-r--r-- | 659 bytes |
| ifcol.cocci | -rw-r--r-- | 1.2 KB |
| irqf_oneshot.cocci | -rw-r--r-- | 1.9 KB |
| noderef.cocci | -rw-r--r-- | 1.2 KB |
| of_table.cocci | -rw-r--r-- | 1.3 KB |
| orplus.cocci | -rw-r--r-- | 900 bytes |
| returnvar.cocci | -rw-r--r-- | 1.2 KB |
| semicolon.cocci | -rw-r--r-- | 1.0 KB |
| warn.cocci | -rw-r--r-- | 1.6 KB |
Computing file changes ...
