Re: [malware-list] A few concerns about fanotify implementation.

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 06/06/2011 05:43 PM, Eric Paris wrote:
Well, you are both correct.  If you add a mark with only 'ignored'
events set it will not pin the inode into the kernel.  If the system
starts to get under memory pressure the kernel will kick unused inodes
and any associated ignored marks out of ram.  Inodes with 'real' events
attached will be pinned in memory and cannot be evicted under memory
pressure.

So if we use marks with only 'ignored' events then under memory pressure mm subsystem will shrink inode cache that will free our marks and therefore it's safe to use FAN_UNLIMITED_MARKS in this case? If it really works then we don't need LRU cache in fanotify because it's already implemented in dentry_cache/inode_cache.

--
Best regards,

Vasily Novikov | Software developer | Kaspersky Lab

Direct: +7 495 123 45 67 x2344 | Mobile: +7 964 786 44 82 | vasily.novikov@xxxxxxxxxxxxx 10/1, 1st Volokolamsky Proezd, Moscow, 123060, Russia | www.kaspersky.com, www.securelist.com
--
To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html


[Index of Archives]     [Linux Ext4 Filesystem]     [Union Filesystem]     [Filesystem Testing]     [Ceph Users]     [Ecryptfs]     [AutoFS]     [Kernel Newbies]     [Share Photos]     [Security]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux Cachefs]     [Reiser Filesystem]     [Linux RAID]     [Samba]     [Device Mapper]     [CEPH Development]
  Powered by Linux