• Miklos Szeredi's avatar
    audit: keep inode pinned · 799b6014
    Miklos Szeredi authored
    Audit rules disappear when an inode they watch is evicted from the cache.
    This is likely not what we want.
    
    The guilty commit is "fsnotify: allow marks to not pin inodes in core",
    which didn't take into account that audit_tree adds watches with a zero
    mask.
    
    Adding any mask should fix this.
    
    Fixes: 90b1e7a5 ("fsnotify: allow marks to not pin inodes in core")
    Signed-off-by: default avatarMiklos Szeredi <mszeredi@suse.cz>
    Cc: stable@vger.kernel.org # 2.6.36+
    Signed-off-by: default avatarPaul Moore <pmoore@redhat.com>
    799b6014
audit_tree.c 22 KB