Revision b5fed474b98332559f2590c6bc90388a0899e793 authored by Jan Kara on 15 August 2017, 11:00:37 UTC, committed by Paul Moore on 15 August 2017, 20:03:00 UTC
Although audit_watch_handle_event() can handle FS_UNMOUNT event, it is not part of AUDIT_FS_WATCH mask and thus such event never gets to audit_watch_handle_event(). Thus fsnotify marks are deleted by fsnotify subsystem on unmount without audit being notified about that which leads to a strange state of existing audit rules with dead fsnotify marks. Add FS_UNMOUNT to the mask of events to be received so that audit can clean up its state accordingly. Signed-off-by: Jan Kara <jack@suse.cz> Signed-off-by: Paul Moore <paul@paul-moore.com>
1 parent d76036a
| File | Mode | Size |
|---|---|---|
| .gitignore | -rw-r--r-- | 151 bytes |
| Kconfig | -rw-r--r-- | 7.5 KB |
| Makefile | -rw-r--r-- | 2.0 KB |
| gen_init_cpio.c | -rw-r--r-- | 12.7 KB |
| initramfs_data.S | -rw-r--r-- | 1.3 KB |
Computing file changes ...
