Re: [malware-list] A few concerns about fanotify implementation.

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Eric,

So if we use marks with only 'ignored' events then under memory pressure
mm subsystem will shrink inode cache that will free our marks and
therefore it's safe to use FAN_UNLIMITED_MARKS in this case?
If it really works then we don't need LRU cache in fanotify because it's
already implemented in dentry_cache/inode_cache.

That's how it's supposed to work.  Just remember, if you set a real
event, the inode becomes pinned in core and the mm will be unable to
evict either the inode or the mark.

It really works) On machine with 2GB ram it holds no more than about 3500000 'ignored' marks in 10 groups. After that it begins to evict LRU files. So it completely satisfies our needs.

What you think about clearing ignored mask not only on FS_MODIFY but also on FS_ATTRIB and FS_MOVE_SELF?

--
Best regards,

Vasily Novikov | Software developer | Kaspersky Lab

Direct: +7 495 123 45 67 x2344 | Mobile: +7 964 786 44 82 | vasily.novikov@xxxxxxxxxxxxx 10/1, 1st Volokolamsky Proezd, Moscow, 123060, Russia | www.kaspersky.com, www.securelist.com
--
To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html


[Index of Archives]     [Linux Ext4 Filesystem]     [Union Filesystem]     [Filesystem Testing]     [Ceph Users]     [Ecryptfs]     [AutoFS]     [Kernel Newbies]     [Share Photos]     [Security]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux Cachefs]     [Reiser Filesystem]     [Linux RAID]     [Samba]     [Device Mapper]     [CEPH Development]
  Powered by Linux