[Bug 216775] New: fanotify reports parent PPID insted of PID for FAN_MODIFY events

[bugzilla-daemon@kernel.org]

https://bugzilla.kernel.org/show_bug.cgi?id=216775

            Bug ID: 216775
           Summary: fanotify reports parent PPID insted of PID for
                    FAN_MODIFY events
           Product: File System
           Version: 2.5
    Kernel Version: 5.15.0
          Hardware: Intel
                OS: Linux
              Tree: Mainline
            Status: NEW
          Severity: normal
          Priority: P1
         Component: ext4
          Assignee: fs_ext4@kernel-bugs.osdl.org
          Reporter: saikiran.gummaraj@icloud.com
        Regression: No

Hello,

While I've been developing a library around fanotify in Go, I noticed that
fanotify subsystem reports the parent process ID in fanotify_event_metadata.pid
instead of the Process ID when mask is set to FAN_MODIFY. I was able to confirm
the error through a test and also manually verifying the PIDs in the audit log.
I did not observe this behaviour for FAN_ACCESS bit.

I've been able to reproduce this on -

Ubuntu 20.04.5 - 5.15.0-53-generic
Ubuntu 22.10 - 5.19.0-23-generic

It can be reproduced by -

git clone git@github.com:opcoder0/fanotify.git
cd fanotify
sudo go test -v

The test "TestWithCapSysAdmFanotifyFileModified" fails reporting pid mismatch.

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are watching the assignee of the bug.