Re: [malware-list] A few concerns about fanotify implementation.

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Mon, 2011-06-06 at 18:42 +0400, Vasily Novikov wrote:
> On 06/06/2011 05:43 PM, Eric Paris wrote:
> > Well, you are both correct.  If you add a mark with only 'ignored'
> > events set it will not pin the inode into the kernel.  If the system
> > starts to get under memory pressure the kernel will kick unused inodes
> > and any associated ignored marks out of ram.  Inodes with 'real' events
> > attached will be pinned in memory and cannot be evicted under memory
> > pressure.
> 
> So if we use marks with only 'ignored' events then under memory pressure 
> mm subsystem will shrink inode cache that will free our marks and 
> therefore it's safe to use FAN_UNLIMITED_MARKS in this case?
> If it really works then we don't need LRU cache in fanotify because it's 
> already implemented in dentry_cache/inode_cache.

That's how it's supposed to work.  Just remember, if you set a real
event, the inode becomes pinned in core and the mm will be unable to
evict either the inode or the mark.

-Eric

--
To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html


[Index of Archives]     [Linux Ext4 Filesystem]     [Union Filesystem]     [Filesystem Testing]     [Ceph Users]     [Ecryptfs]     [AutoFS]     [Kernel Newbies]     [Share Photos]     [Security]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux Cachefs]     [Reiser Filesystem]     [Linux RAID]     [Samba]     [Device Mapper]     [CEPH Development]
  Powered by Linux