RE: [malware-list] A few concerns about fanotify implementation.

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 03/06/11 10:43, Vasily Novikov wrote:
> Hi Eric,
>
> We are moving to fanotify at the moment. It meets our needs except
> couple minor issues we would like to be fixed in future versions:
>
> 1. The file is thrown out of the cache only when it is modified. But in
> case there are different scan options for different dirs that's not
> enough. So we also need it to be evicted from cache on rename or number
> of hard links change.
> It is the most important issue for us.
> The patch is in attachment: add_clear_cache_events.patch


This is interesting, as it makes the cache less efficient for those
users who don't have different scanning within a filesystem.

Our only equivalent things are exclusions, which we handle by not
marking the responses for exclusions as cache-able.


>
> 2. We can't use unlimited cache because it can potentially grab too much
> memory and slow down a system. In case we use limited cache it can be
> easily filled with not very frequently used files. So the only option we
> have at the moment is to clear cache every time it is full.
> The solution we consider the most appropriate is to introduce
> replaceable marks and LRU cache for them in fanotify.
> So we suggest to introduce a new flag FAN_MARK_REPLACEABLE for marks.
> That will not break the current API.
> The patch is in attachment: marks_lru_cache.patch


IIRC the cache is stored in the inodes themselves, so will automatically
be culled as inodes are pushed out of memory?


>
> 3. The fanotify file descriptor is always ready to be written to it. But
> it's poll method says the opposite. In case you handle it by yourself
> that's not a problem. But in case you use some async io library as we do
> that polls fds internally it doesn't work.
> The patch is in attachment: fanotify_write_poll.patch
>

This seems like a good fix.


--
Douglas Leeder, Senior Software Engineer

Sophos Limited, The Pentagon, Abingdon Science Park, Abingdon, OX14 3YP, United Kingdom.
Company Reg No 2096520. VAT Reg No GB 991 2418 08.
ÿô.nlj·Ÿ®‰­†+%ŠË±é¥Šwÿº{.nlj·¥Š{±ýþ)íèjg¬±¨¶‰šŽŠÝjÿ¾«þG«é¸¢·¦j:+v‰¨Šwèm¶Ÿÿþø®w¥þŠà£¢·hšâÿ†Ù



[Index of Archives]     [Linux Ext4 Filesystem]     [Union Filesystem]     [Filesystem Testing]     [Ceph Users]     [Ecryptfs]     [AutoFS]     [Kernel Newbies]     [Share Photos]     [Security]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux Cachefs]     [Reiser Filesystem]     [Linux RAID]     [Samba]     [Device Mapper]     [CEPH Development]
  Powered by Linux