Messages in this thread | | | Subject | Re: [malware-list] TALPA - a threat model? well sorta. | From | Eric Paris <> | Date | Thu, 14 Aug 2008 15:20:44 -0400 |
| |
On Thu, 2008-08-14 at 15:17 -0400, Theodore Tso wrote: > On Thu, Aug 14, 2008 at 01:29:45PM -0400, Eric Paris wrote: > > > > is i_version an on disk think? didn't realize that and just assumed it > > was in in core thing. I wouldn't have an issue sending i_version to the > > userspace scanner for them to use as they like. > > > > It's on-disk for some filesystems, in order to support NFsv4 advanced > caching semantics (which means i_version has to survive a reboot, > which means it has to be on disk). It is *not* on disk for ext3, > although it is for ext4.
Is there some pragmatic way in kernel to know if the inode I have corresponds to a persistent or in core only inode? I'll poke around myself and look.
-Eris
| |