Re: [PATCH 05/35] audit_tree: Use mark flags to check whether mark is alive

[Jan Kara <jack@suse.cz>]

On Thu 06-04-17 07:51:48, Paul Moore wrote:
> On Wed, Apr 5, 2017 at 3:38 AM, Jan Kara <jack@suse.cz> wrote:
> > On Tue 04-04-17 16:47:11, Paul Moore wrote:
> >> On Mon, Apr 3, 2017 at 11:33 AM, Jan Kara <jack@suse.cz> wrote:
> >> > Currently audit code uses checking of mark->inode to verify whether mark
> >> > is still alive. Switch that to checking mark flags as that is more
> >> > logical and current way will become unreliable in future.
> >> >
> >> > Reviewed-by: Miklos Szeredi <mszeredi@redhat.com>
> >> > Signed-off-by: Jan Kara <jack@suse.cz>
> >> > ---
> >> >  kernel/audit_tree.c | 4 ++--
> >> >  1 file changed, 2 insertions(+), 2 deletions(-)
> >>
> >> Should audit_tree.c:insert_hash() also be updated in a similar manner?
> >
> > Do you mean the part which has become chunk_to_key()? ...
> 
> No, I was talking about the if conditional near the top of the
> function that checks to see if the fsnotify_mark's inode is non-NULL;
> it seems like you would also want to convert that to a
> FSNOTIFY_MARK_FLAG_ATTACHED, yes?

Ah, that one. Yes, that can certainly become a FSNOTIFY_MARK_FLAG_ATTACHED
check although I cannot currently come up with a situation where it would
matter. But it looks safer that way so I'll change that check as you
suggest.

								Honza
-- 
Jan Kara <jack@suse.com>
SUSE Labs, CR