Re: close(2) not being audited?

[James Antill <jantill@redhat.com>]

[-- Attachment #1.1: Type: text/plain, Size: 787 bytes --]

On Fri, 2007-01-26 at 17:46 -0600, Timothy R. Chavez wrote:

> Yep, I was referring to last reference to opened file.
> 
> I'd hate to suggest adding a field to the file like "opened_as" which would
> store the original fd it was assigned, but that would be enough to associate
> the open() record and the final "close" record.


fd1 = open(...);
ptr1 = mmap(fd1, ...);
close(fd1);

fd2 = open(...);
assert(fd1 == fd2);
ptr2 = mmap(fd2, ...);
close(fd2);

munmap(ptr1, ...);
munmap(ptr2, ...);

...what should appear in the logs here? How are you going to tell which
fd each munmap() belongs to?
 Maybe you mean "log inode/device for the file" and not "original fd",
and then if/when you get confused it doesn't matter?

-- 
James Antill <jantill@redhat.com>

[-- Attachment #1.2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]