Re: fanotify: the fscking all notification system

[Sukadev Bhattiprolu <sukadev@linux.vnet.ibm.com>]

| > struct fanotify_event_metadata {
| >         __u32 event_len;
| >         __s32 fd;
| >         __u32 mask;
| >         __u32 f_flags;
| >         pid_t pid;
| >         pid_t tgid;
| >         __u64 cookie;
| > }  __attribute__((packed));
| 
| Since it passes pids from the kernel to userspace via a socket I suspect
| this needs input from the folks working on pid namespaces. The events may
| need to be dropped if the pid namespace of the event's origin doesn't
| match that of the destination. Otherwise the pid would be ambiguous and
| this interface will only work for tasks in the initial pid namespace.

If we do have the destination pid namespace, we could translate the pid
of the process modifying the file, into the pid namespace of the process
receiving the notification, like we do in mq_notify().

So when a process in an ancestor or unrelated pid namespace modifies the
file, the si_pid would get set to 0. 

Sukadev