Skip to content

ROX-33216: implement inode tracking for path_rename#487

Open
Molter73 wants to merge 2 commits intomauro/refactor-submit-eventfrom
mauro/ROX-33216/inode-tracking-rename
Open

ROX-33216: implement inode tracking for path_rename#487
Molter73 wants to merge 2 commits intomauro/refactor-submit-eventfrom
mauro/ROX-33216/inode-tracking-rename

Conversation

@Molter73
Copy link
Copy Markdown
Contributor

@Molter73 Molter73 commented Apr 9, 2026

Description

This is a first attempt at adding inode tracking to the path_rename LSM hook. A number of changes were needed in order to cover all the possible edge cases in this operation.

The most important change is that inodes are now always sent to userspace alongside with a value that indicates how the event is triggered (by matching an inode or a path), this was needed because the path_rename operation will use an inode number of 0 the same we were doing when the new path is not populated (i.e there is no file on the path we are landing). As a side effect of this, inodes on the kernel side cannot be NULL, some additional cleanup might be needed.

Properly tracking rename operations requires collaboration between kernelspace and userspace, particularly when renaming a directory. In this case, the LSM hook will trigger once and we have no way of iterating through subdirectories and files contained in the directories involved, so the kernel does its best effort with the available information and leaves the heavy lifting to userspace. Where possible, userspace will use the available information in memory to adjust the paths being tracked, any discrepancies will be sorted by (hopefully) subsequent events or a periodic scan of the host. The logic on both sides is documented as thoroughly as possible.

Checklist

  • Investigated and inspected CI test results
  • Updated documentation accordingly

Automated testing

  • Added unit tests
  • Added integration tests
  • Added regression tests

If any of these don't apply, please comment below.

Testing Performed

Manually tested and added multiple integration tests.

@Molter73 Molter73 force-pushed the mauro/ROX-33216/inode-tracking-rename branch from f6855df to c5bd4f2 Compare April 10, 2026 10:05
@Molter73 Molter73 force-pushed the mauro/refactor-submit-event branch from a861f3d to 96c8f45 Compare April 10, 2026 10:49
@Molter73 Molter73 force-pushed the mauro/ROX-33216/inode-tracking-rename branch from c5bd4f2 to 0d364d0 Compare April 10, 2026 13:05
This is a first attempt at adding inode tracking to the path_rename LSM
hook. A number of changes were needed in order to cover all the possible
edge cases in this operation.

The most important change is that inodes are now always sent to
userspace alongside with a value that indicates how the event is
triggered (by matching an inode or a path), this was needed because the
path_rename operation will use an inode number of 0 the same we were
doing when the new path is not populated (i.e there is no file on the
path we are landing). As a side effect of this, inodes on the kernel
side cannot be NULL, some additional cleanup might be needed.

Properly tracking rename operations requires collaboration between
kernelspace and userspace, particularly when renaming a directory. In
this case, the LSM hook will trigger once and we have no way of
iterating through subdirectories and files contained in the directories
involved, so the kernel does its best effort with the available
information and leaves the heavy lifting to userspace. Where possible,
userspace will use the available information in memory to adjust the
paths being tracked, any discrepancies will be sorted by (hopefully)
subsequent events or a periodic scan of the host. The logic on both
sides is documented as thoroughly as possible.
In order to validate more of the inode tracking functionality in
path_rename more test cases and additional validations are added.
@Molter73 Molter73 force-pushed the mauro/ROX-33216/inode-tracking-rename branch from 0d364d0 to c115b4d Compare April 10, 2026 14:17
@Molter73 Molter73 marked this pull request as ready for review April 10, 2026 15:22
@Molter73 Molter73 requested a review from a team as a code owner April 10, 2026 15:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant