Re: Symlink reporting

Sami Tikka wrote:
> On Linux 2.6 I guess the way to go is to set up an inode_follow_link 
> callback and report the symlink access from there. Unfortunately, when 
> the inode_permission callback is called, there is no way to know if 
> inode_follow_link was called previously. This means that on Linux 2.6 
> the dazuko driver would report file accesses thru symlink twice: first 
> the access to the symlink and then the access to the real file.

To correct myself: We solved this double-reporting problem so that we 
introduced a new event type to dazuko: LINK. When the inode_follow_link 
is called, it is reported to daemon as a LINK type event. When 
inode_permission is called, it is reported as OPEN or EXEC as usual.

Any opinions or better ideas?

-- 
Sami Tikka                          tel: +358 9 2520 5115
Senior Software Engineer            fax: +358 9 2520 5013
F-Secure Corporation                http://www.F-Secure.com/
Be Sure.