From: Richard Guy Briggs <rgb@redhat.com>
To: Peter Grandi <pg@aud.list.sabi.co.UK>
Cc: Linux audit <linux-audit@redhat.com>
Subject: Re: peculiar disappearance of most audit rules
Date: Wed, 5 Nov 2014 11:55:48 -0500 [thread overview]
Message-ID: <20141105165548.GQ26201@madcap2.tricolour.ca> (raw)
In-Reply-To: <21341.27038.918993.838943@tree.ty.sabi.co.uk>
On 14/04/27, Peter Grandi wrote:
> > but in either case, the inodes aren't supposed to be able to
> > be kicked out of core...
>
> But on 3 different system I have they really seem to be evicted,
> and with regularity, and this does not happen if the inodes are
> kept open.
>
> From the source I have looked at, the *notify code seems to
> attempt to hold on to the inodes that are watched, but perhaps
> it has some hidden assumptions that the 'audit' module does not
> satisfy.
Do you have a reproducer to detect this quickly?
Miklos Szeredi appears to have found the likely cause:
https://lkml.org/lkml/2014/11/4/246
- RGB
--
Richard Guy Briggs <rbriggs@redhat.com>
Senior Software Engineer, Kernel Security, AMER ENG Base Operating Systems, Red Hat
Remote, Ottawa, Canada
Voice: +1.647.777.2635, Internal: (81) 32635, Alt: +1.613.693.0684x3545
prev parent reply other threads:[~2014-11-05 16:55 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-04-21 17:49 peculiar disappearance of most audit rules Peter Grandi
2014-04-21 18:28 ` Steve Grubb
2014-04-21 18:35 ` lists_todd
2014-04-21 19:03 ` Eric Paris
2014-04-21 20:49 ` Peter Grandi
2014-04-22 20:53 ` Peter Grandi
2014-04-22 21:46 ` Steve Grubb
2014-04-23 8:04 ` Peter Grandi
2014-04-23 14:34 ` Eric Paris
2014-04-27 20:33 ` Peter Grandi
2014-11-05 16:55 ` Richard Guy Briggs [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20141105165548.GQ26201@madcap2.tricolour.ca \
--to=rgb@redhat.com \
--cc=linux-audit@redhat.com \
--cc=pg@aud.list.sabi.co.UK \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox