The future of the Linux Security Module API
Posted Apr 29, 2006 9:31 UTC (Sat) by anton
Parent article: The future of the Linux Security Module API
Rlocate, a version
of locate that is always up-to-date, uses LSM to hook into the
appropriate system calls (open() etc.).
Why hasn't this been submitted to the mainline? I don't know, but
I guess if it were included in the mainline, it would not use LSM.
Doesn't inotify cover the functionality that the rlocate kernel
module provides? Unfortunately not, because inotify only supports
watching specific directories, not whole file systems or the whole file hierarchy.
Even if you watched all directories currently in the file hierarchy
(which is probably a performance problem), you would get a race
condition when a new directory is created: there might be files
created between the time when the directory is created, and the time
when the directory is registered with inotify, so the database would
miss some files; this is very likely to happen when unpacking a tar or
to post comments)