From mboxrd@z Thu Jan 1 00:00:00 1970 From: Andreas Dilger Subject: Re: fanotify - overall design before I start sending patches Date: Mon, 27 Jul 2009 12:33:54 -0600 Message-ID: <20090727183354.GM4231@webber.adilger.int> References: <1248466429.3567.82.camel@localhost> <20090724224813.GK27755@shareable.org> <1248479367.3567.133.camel@localhost> <20090725002916.GB13556@shareable.org> Mime-Version: 1.0 Content-Type: text/plain; CHARSET=US-ASCII Content-Transfer-Encoding: 7BIT Cc: Eric Paris , linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org, malware-list@dmesg.printk.net, Valdis.Kletnieks@vt.edu, greg@kroah.com, jcm@redhat.com, douglas.leeder@sophos.com, tytso@mit.edu, arjan@infradead.org, david@lang.hm, jengelh@medozas.de, aviro@redhat.com, mrkafk@gmail.com, alexl@redhat.com, jack@suse.cz, tvrtko.ursulin@sophos.com, a.p.zijlstra@chello.nl, hch@infradead.org, alan@lxorguk.ukuu.org.uk, mmorley@hcl.in, pavel@suse.cz To: Jamie Lokier Return-path: Received: from sca-es-mail-2.Sun.COM ([192.18.43.133]:58083 "EHLO sca-es-mail-2.sun.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752230AbZG0Seq (ORCPT ); Mon, 27 Jul 2009 14:34:46 -0400 Content-disposition: inline In-reply-to: <20090725002916.GB13556@shareable.org> Sender: linux-fsdevel-owner@vger.kernel.org List-ID: On Jul 25, 2009 01:29 +0100, Jamie Lokier wrote: > Eric Paris wrote: > > But maybe I should jsut do the 'if you have fanotify open, you don't > > create other fanotify events'... so everyone gets what they expect... > > O_NONOTIFY. Similar security concerns, more control. > > The security concern is clear: If you allow a process with fanotify > open to not create events, then any (root) process can open a fanotify > socket to hide it's behaviour. I think the "fanotify doesn't generate more fanotify events" makes the most sense. Given that the open will be done in the kernel specifically due to fanotify, this doesn't actually allow the listener to open files without detection (unlike the "O_NONOTIFY" flag would). The fanotify "opens" would only be in response to other processes opening the file. It might also make sense to verify that the process doing the open has at least permission to open the file in question (i.e. root) so that some unauthorized process cannot just get file handles to arbitrary files. Cheers, Andreas -- Andreas Dilger Sr. Staff Engineer, Lustre Group Sun Microsystems of Canada, Inc.