https://bugzilla.kernel.org/show_bug.cgi?id=216775 Bug ID: 216775 Summary: fanotify reports parent PPID insted of PID for FAN_MODIFY events Product: File System Version: 2.5 Kernel Version: 5.15.0 Hardware: Intel OS: Linux Tree: Mainline Status: NEW Severity: normal Priority: P1 Component: ext4 Assignee: fs_ext4@xxxxxxxxxxxxxxxxxxxx Reporter: saikiran.gummaraj@xxxxxxxxxx Regression: No Hello, While I've been developing a library around fanotify in Go, I noticed that fanotify subsystem reports the parent process ID in fanotify_event_metadata.pid instead of the Process ID when mask is set to FAN_MODIFY. I was able to confirm the error through a test and also manually verifying the PIDs in the audit log. I did not observe this behaviour for FAN_ACCESS bit. I've been able to reproduce this on - Ubuntu 20.04.5 - 5.15.0-53-generic Ubuntu 22.10 - 5.19.0-23-generic It can be reproduced by - git clone git@xxxxxxxxxx:opcoder0/fanotify.git cd fanotify sudo go test -v The test "TestWithCapSysAdmFanotifyFileModified" fails reporting pid mismatch. -- You may reply to this email to add a comment. You are receiving this mail because: You are watching the assignee of the bug.
