|
From: | Sami Tikka |
Subject: | Re: [Dazuko-devel] Symlink reporting |
Date: | Thu, 20 Jan 2005 16:30:21 +0200 |
User-agent: | Mozilla Thunderbird 1.0 (X11/20050103) |
Sami Tikka wrote:
On Linux 2.6 I guess the way to go is to set up an inode_follow_link callback and report the symlink access from there. Unfortunately, when the inode_permission callback is called, there is no way to know if inode_follow_link was called previously. This means that on Linux 2.6 the dazuko driver would report file accesses thru symlink twice: first the access to the symlink and then the access to the real file.
To correct myself: We solved this double-reporting problem so that we introduced a new event type to dazuko: LINK. When the inode_follow_link is called, it is reported to daemon as a LINK type event. When inode_permission is called, it is reported as OPEN or EXEC as usual.
Any opinions or better ideas? -- Sami Tikka tel: +358 9 2520 5115 Senior Software Engineer fax: +358 9 2520 5013 F-Secure Corporation http://www.F-Secure.com/ Be Sure.
[Prev in Thread] | Current Thread | [Next in Thread] |