From mboxrd@z Thu Jan  1 00:00:00 1970
From: "Timothy R. Chavez" <tinytim@us.ibm.com>
Subject: Re: close(2) not being audited?
Date: Mon, 29 Jan 2007 14:19:31 -0600
Message-ID: <20070129141931.75da4731@crumpet>
References: <C482FF98AE985A47B8C982FD429C9E3401370D58@daytonmsg2k3.AERO.BALL.COM>
	<200701261237.40345.sgrubb@redhat.com>
	<FC11D747323EB24493CDC753367EEB92019FA4D3@aplesnation.dom1.jhuapl.edu>
	<20070126221933.GF14621@devserv.devel.redhat.com>
	<20070126170112.6ac08156@crumpet>
	<20070126232051.GG14621@devserv.devel.redhat.com>
	<20070126174625.3f26c955@crumpet>
	<1170020456.26475.6.camel@code.and.org>
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
In-Reply-To: <1170020456.26475.6.camel@code.and.org>
List-Unsubscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: James Antill <jantill@redhat.com>
Cc: linux-audit@redhat.com
List-Id: linux-audit@redhat.com

On Sun, 28 Jan 2007 16:40:56 -0500
James Antill <jantill@redhat.com> wrote:

> On Fri, 2007-01-26 at 17:46 -0600, Timothy R. Chavez wrote:
> 
> > Yep, I was referring to last reference to opened file.
> > 
> > I'd hate to suggest adding a field to the file like "opened_as" which would
> > store the original fd it was assigned, but that would be enough to associate
> > the open() record and the final "close" record.
> 
> 
> fd1 = open(...);
> ptr1 = mmap(fd1, ...);
> close(fd1);
> 
> fd2 = open(...);
> assert(fd1 == fd2);
> ptr2 = mmap(fd2, ...);
> close(fd2);
> 
> munmap(ptr1, ...);
> munmap(ptr2, ...);
> 
> ...what should appear in the logs here? How are you going to tell which
> fd each munmap() belongs to?
>  Maybe you mean "log inode/device for the file" and not "original fd",
> and then if/when you get confused it doesn't matter?
> 

Well yes, I was assuming you would have the additional context provided by other
fields in the record such as inode and device, but on second thought, I think you
are right that such information should be sufficient to tie the "close" record with
the open() record without needing to correlate an fd between the two (which, like
you suggest, would be ambiguous without the additional context, anyway).

-tim