2.0.5-pre1 posted

Hi,

I have just posted Dazuko 2.0.5-pre1. Aside from supporting the new 
changes to the LSM interface for Linux 2.6.10, it also includes many of 
the FreeBSD features ported to Linux 2.2/2.4. These include dup() and 
dup2() support and handling the "link problem" issue.

With dup/dup2 support, this means that events such as:

echo "Hello, world!" > test.txt

will now be correctly detected (with OPEN and CLOSE events). The "link 
problem" is as follows:

- Dazuko is watching /tmp/
- /tmp/file1 is a link to an unwatched file (for example, /var/file2)
- when /tmp/file1 was open/closed, Dazuko did not notice (because it was 
actually /var/file2 that was modified)

This problem has been fixed for FreeBSD 4/5 (since 2.0.4) and Linux 
2.2/2.4 (as of this pre-release) but still exists for Linux 2.6 and 
Linux/RSBAC.

Something else that is making me crazy is the list of open files. There 
are files that are being opened, but Dazuko does not see when they are 
closed. This causes a "hash-list leak" in Dazuko, which over time makes 
Dazuko very slow. This has already been observed and reported by some 
users. This problem exists for Linux 2.2/2.4 and FreeBSD 4/5. I have a 
couple ideas about what might be going on, but I need to sit down and 
just work through it.

John Ogness

-- 
Dazuko Maintainer