Re: OpenAFS 1.8.7 on Linux systems running Crowdstrike falcon-sensor

Chaskiel Grundman <[email protected]>
Newsgroups gmane.comp.file-systems.openafs.general
Message-ID <CA+-VZgD6fqmjTJXoOgUTkZV3x92uxzUsczb3Ky42Z1j_SGpihA@mail.gmail.com>
The bad news is, override_creds isn't going to fix this, because
current->fs isn't part of the creds. It's still going to be null (h/t jhutz)
The less bad news is, I think this will only affect closing a deleted file.
Other operations should not trigger cache I/O after a flush. (exit_files,
which occurs before exit_fs, called flush and fput, but fput these days
doesn't do the work immediately, it punts it to task_work). So if we punt
the unlink of a sillyrenamed file to a kthread, we should be able to avoid
this problem.

But we may have other issues.
If crowdstrike is validating dentry_open against current->fs->root, it
might deny cache I/O done on behalf of a chroot'd (or namespaced) process.
We can't solve that without punting ALL cache I/O to a kthread.
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.