Revision b5fed474b98332559f2590c6bc90388a0899e793 authored by Jan Kara on 15 August 2017, 11:00:37 UTC, committed by Paul Moore on 15 August 2017, 20:03:00 UTC
Although audit_watch_handle_event() can handle FS_UNMOUNT event, it is not part of AUDIT_FS_WATCH mask and thus such event never gets to audit_watch_handle_event(). Thus fsnotify marks are deleted by fsnotify subsystem on unmount without audit being notified about that which leads to a strange state of existing audit rules with dead fsnotify marks. Add FS_UNMOUNT to the mask of events to be received so that audit can clean up its state accordingly. Signed-off-by: Jan Kara <jack@suse.cz> Signed-off-by: Paul Moore <paul@paul-moore.com>
1 parent d76036a
of_table.cocci
/// Make sure (of/i2c/platform)_device_id tables are NULL terminated
//
// Keywords: of_table i2c_table platform_table
// Confidence: Medium
// Options: --include-headers
virtual patch
virtual context
virtual org
virtual report
@depends on context@
identifier var, arr;
expression E;
@@
(
struct \(of_device_id \| i2c_device_id \| platform_device_id\) arr[] = {
...,
{
.var = E,
* }
};
|
struct \(of_device_id \| i2c_device_id \| platform_device_id\) arr[] = {
...,
* { ..., E, ... },
};
)
@depends on patch@
identifier var, arr;
expression E;
@@
(
struct \(of_device_id \| i2c_device_id \| platform_device_id\) arr[] = {
...,
{
.var = E,
- }
+ },
+ { }
};
|
struct \(of_device_id \| i2c_device_id \| platform_device_id\) arr[] = {
...,
{ ..., E, ... },
+ { },
};
)
@r depends on org || report@
position p1;
identifier var, arr;
expression E;
@@
(
struct \(of_device_id \| i2c_device_id \| platform_device_id\) arr[] = {
...,
{
.var = E,
}
@p1
};
|
struct \(of_device_id \| i2c_device_id \| platform_device_id\) arr[] = {
...,
{ ..., E, ... }
@p1
};
)
@script:python depends on org@
p1 << r.p1;
arr << r.arr;
@@
cocci.print_main(arr,p1)
@script:python depends on report@
p1 << r.p1;
arr << r.arr;
@@
msg = "%s is not NULL terminated at line %s" % (arr, p1[0].line)
coccilib.report.print_report(p1[0],msg)
![swh spinner](/static/img/swh-spinner.gif)
Computing file changes ...