[Bug 152796] fcntl(2) audit records should not be labeled "file attribute modify"

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=152796

Alan Somers <asomers at FreeBSD.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |aniketp at freebsd.org,
                   |                            |asomers at FreeBSD.org

--- Comment #3 from Alan Somers <asomers at FreeBSD.org> ---
I think fcntl should simply be moved into the "no" class, because none of its
commands are security-relevant.  It doesn't really affect the file on-disk at
all, just the way that the process accesses the file.  It combines the
functionality of dup2 ("no" class) with some of the obscure open(2) options
(open is audited, but those options aren't treated specially), with
sigaction(2) ("no" class), with flock ("fm" class).  It also adds the ability
to set file readahead (not security relevant).  The only commands that affect
the file itself are the locking commands.  I would argue that, since they're
advisory and very frequently used, the file locking operations shouldn't be
auditted.

-- 
You are receiving this mail because:
You are the assignee for the bug.