From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Timothy R. Chavez" Subject: Re: close(2) not being audited? Date: Fri, 26 Jan 2007 17:46:25 -0600 Message-ID: <20070126174625.3f26c955@crumpet> References: <200701261237.40345.sgrubb@redhat.com> <20070126221933.GF14621@devserv.devel.redhat.com> <20070126170112.6ac08156@crumpet> <20070126232051.GG14621@devserv.devel.redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <20070126232051.GG14621@devserv.devel.redhat.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Alexander Viro Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Fri, 26 Jan 2007 18:20:51 -0500 Alexander Viro wrote: > On Fri, Jan 26, 2007 at 05:01:12PM -0600, Timothy R. Chavez wrote: > > > Please, define "access". Consider the following sequence: > > > on April 1st: > > > fd = open(foo, O_RDWR); > > > p = mmap(..., fd, ...); > > > close(fd); > > > two days later: modify area pointed to by p > > > a month later: munmap(p, ...); > > > > > > What do you want in the log? More specifically, _when_ do you want it? > > > > Write out a log when the last reference to the fd is put back... whether > > that's from a close or an munmap. > > Sigh... One more time: there are two distinct classes of objects - opened > files and opened descriptors. That's the point - by the time of munmap() > there is no file descriptor at all. It's been gone for a month. > > Descriptor getting closed != file getting closed. If you are talking about > the last reference to opened file - OK. But there won't necessary be > any descriptors refering to it. Yep, I was referring to last reference to opened file. I'd hate to suggest adding a field to the file like "opened_as" which would store the original fd it was assigned, but that would be enough to associate the open() record and the final "close" record. -tim PS: Ugh, at this list for being write-protected :).