From mboxrd@z Thu Jan 1 00:00:00 1970 From: Vasily Novikov Subject: Re: [malware-list] A few concerns about fanotify implementation. Date: Mon, 6 Jun 2011 18:42:54 +0400 Message-ID: <4DECE76E.4060507@kaspersky.com> References: <1288095195.29745.4010.camel@novikov-v> <201010261358.46974.tvrtko.ursulin@sophos.com> <1288169699.7715.103.camel@novikov-v> <1288195134.2655.202.camel@localhost.localdomain> <4DE8ACAD.2080003@kaspersky.com> <4DEC9B86.6060506@kaspersky.com> <1307367787.2052.6.camel@localhost.localdomain> Mime-Version: 1.0 Content-Type: text/plain; charset="UTF-8"; format=flowed Content-Transfer-Encoding: 7bit Cc: Douglas Leeder , "linux-fsdevel@vger.kernel.org" , "malware-list@dmesg.printk.net" To: Eric Paris Return-path: Received: from relay3.kaspersky-labs.com ([91.103.66.246]:60749 "EHLO relay3.kaspersky-labs.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752220Ab1FFOlQ (ORCPT ); Mon, 6 Jun 2011 10:41:16 -0400 Received: from relay3.kaspersky-labs.com (localhost [127.0.0.1]) by mx3.kaspersky-labs.com (Postfix) with ESMTP id D1C4C4021731 for ; Mon, 6 Jun 2011 18:41:13 +0400 (MSD) Received: from kas30pipe.localhost (localhost [127.0.0.1]) by mx3.kaspersky-labs.com (Postfix) with ESMTP id 4B4E44021723 for ; Mon, 6 Jun 2011 18:41:13 +0400 (MSD) In-Reply-To: <1307367787.2052.6.camel@localhost.localdomain> Sender: linux-fsdevel-owner@vger.kernel.org List-ID: On 06/06/2011 05:43 PM, Eric Paris wrote: > Well, you are both correct. If you add a mark with only 'ignored' > events set it will not pin the inode into the kernel. If the system > starts to get under memory pressure the kernel will kick unused inodes > and any associated ignored marks out of ram. Inodes with 'real' events > attached will be pinned in memory and cannot be evicted under memory > pressure. So if we use marks with only 'ignored' events then under memory pressure mm subsystem will shrink inode cache that will free our marks and therefore it's safe to use FAN_UNLIMITED_MARKS in this case? If it really works then we don't need LRU cache in fanotify because it's already implemented in dentry_cache/inode_cache. -- Best regards, Vasily Novikov | Software developer | Kaspersky Lab Direct: +7 495 123 45 67 x2344 | Mobile: +7 964 786 44 82 | vasily.novikov@kaspersky.com 10/1, 1st Volokolamsky Proezd, Moscow, 123060, Russia | www.kaspersky.com, www.securelist.com