Revision b5fed474b98332559f2590c6bc90388a0899e793 authored by Jan Kara on 15 August 2017, 11:00:37 UTC, committed by Paul Moore on 15 August 2017, 20:03:00 UTC
Although audit_watch_handle_event() can handle FS_UNMOUNT event, it is not part of AUDIT_FS_WATCH mask and thus such event never gets to audit_watch_handle_event(). Thus fsnotify marks are deleted by fsnotify subsystem on unmount without audit being notified about that which leads to a strange state of existing audit rules with dead fsnotify marks. Add FS_UNMOUNT to the mask of events to be received so that audit can clean up its state accordingly. Signed-off-by: Jan Kara <jack@suse.cz> Signed-off-by: Paul Moore <paul@paul-moore.com>
1 parent d76036a
orplus.cocci
/// Check for constants that are added but are used elsewhere as bitmasks
/// The results should be checked manually to ensure that the nonzero
/// bits in the two constants are actually disjoint.
///
// Confidence: Moderate
// Copyright: (C) 2013 Julia Lawall, INRIA/LIP6. GPLv2.
// Copyright: (C) 2013 Gilles Muller, INRIA/LIP6. GPLv2.
// URL: http://coccinelle.lip6.fr/
// Comments:
// Options: --no-includes --include-headers
virtual org
virtual report
virtual context
@r@
constant c;
identifier i;
expression e;
@@
(
e | c@i
|
e & c@i
|
e |= c@i
|
e &= c@i
)
@s@
constant r.c,c1;
identifier i1;
position p;
@@
(
c1 + c - 1
|
*c1@i1 +@p c
)
@script:python depends on org@
p << s.p;
@@
cocci.print_main("sum of probable bitmasks, consider |",p)
@script:python depends on report@
p << s.p;
@@
msg = "WARNING: sum of probable bitmasks, consider |"
coccilib.report.print_report(p[0],msg)
Computing file changes ...
