fanotify and pidfd?

fanotify and pidfd?

[Marko Rauhamaa]

As it stands, fanotify reports the process ID of the file that is being
operated on:

           struct fanotify_event_metadata {
               __u32 event_len;
               __u8 vers;
               __u8 reserved;
               __u16 metadata_len;
               __aligned_u64 mask;
               __s32 fd;
               __s32 pid;
           };

One nasty problem with this is that the process often is long gone by
the time the notification arrives.

Would it be possible to amend this format with:

               __s32 pidfd;

It would hold the pid still for the duration of notification processing
and allow for the fanotify monitor to safely use the pid field to
inspect /proc/<pid>.

And the possibility of sending signals to the monitored process might
come in handy as well.

Thinking about this a bit more, could the fd field take on the dual role
of allowing you to read the file in question as well as acting as a
pidfd?


Marko

Re: fanotify and pidfd?

[Amir Goldstein]

On Fri, Jun 7, 2019 at 5:31 PM Marko Rauhamaa
<marko.rauhamaa@f-secure.com> wrote:
>
>
> As it stands, fanotify reports the process ID of the file that is being
> operated on:
>
>            struct fanotify_event_metadata {
>                __u32 event_len;
>                __u8 vers;
>                __u8 reserved;
>                __u16 metadata_len;
>                __aligned_u64 mask;
>                __s32 fd;
>                __s32 pid;
>            };
>
> One nasty problem with this is that the process often is long gone by
> the time the notification arrives.
>
> Would it be possible to amend this format with:
>
>                __s32 pidfd;
>

It's possible to report pidfd instead of pid with user opt-in
(i.e. FAN_REPORT_PIDFD)

If you want to implement this, follow the footsteps of code, test and
man page for FAN_REPORT_TID.

> It would hold the pid still for the duration of notification processing
> and allow for the fanotify monitor to safely use the pid field to
> inspect /proc/<pid>.
>

It will hold pid until someone closes pidfd.
That also needs to be documented.

> And the possibility of sending signals to the monitored process might
> come in handy as well.
>
> Thinking about this a bit more, could the fd field take on the dual role
> of allowing you to read the file in question as well as acting as a
> pidfd?
>

Please no.

Thanks,
Amir.

Re: fanotify and pidfd?

[Marko Rauhamaa]

Amir Goldstein <amir73il@gmail.com>:

> On Fri, Jun 7, 2019 at 5:31 PM Marko Rauhamaa
> <marko.rauhamaa@f-secure.com> wrote:
>> Would it be possible to amend this format with:
>>
>>                __s32 pidfd;
>>
>
> It's possible to report pidfd instead of pid with user opt-in
> (i.e. FAN_REPORT_PIDFD)
>
> If you want to implement this, follow the footsteps of code, test and
> man page for FAN_REPORT_TID.

I hear you.


Marko