Skip to content

ROX-33218: Instrument inode tracking on directory being deleted#530

Open
JoukoVirtanen wants to merge 12 commits intomainfrom
jv-ROX-33218-instrument-inode-tracking-on-directory-being-deleted
Open

ROX-33218: Instrument inode tracking on directory being deleted#530
JoukoVirtanen wants to merge 12 commits intomainfrom
jv-ROX-33218-instrument-inode-tracking-on-directory-being-deleted

Conversation

@JoukoVirtanen
Copy link
Copy Markdown
Contributor

Description

Removes inodes for directories from the maps in kernel and userspace when they are deleted

Checklist

  • Investigated and inspected CI test results
  • Updated documentation accordingly

Automated testing

  • Added unit tests
  • Added integration tests
  • Added regression tests

If any of these don't apply, please comment below.

Testing Performed

Ran tests locally. Tests were created first and they failed. Then they were made to pass. Initially the tests expected directory deletion events, but then it was made so that directory deletion events were no longer reported and then the tests failed. Finally the tests were modified so that they did not expect to see directory deletion events and they passed.

@JoukoVirtanen JoukoVirtanen marked this pull request as ready for review April 19, 2026 17:17
@JoukoVirtanen JoukoVirtanen requested a review from a team as a code owner April 19, 2026 17:17
Comment thread fact-ebpf/src/bpf/main.c
inode_key_t inode_key = inode_to_key(dentry->d_inode);
inode_key_t* inode_to_submit = &inode_key;

if (is_monitored(inode_key, path, NULL, &inode_to_submit) == NOT_MONITORED) {
Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This follows the same pattern as file unlinking, but I wonder if both could be simplified. I don't think we need to check is_monitored. I think it is probably better to just directly call inode_remove. If the inode is in the map then it needs to be removed. There could potentially be a bug where is_monitored return NOT_MONITORED, but the inode is in the map and needs to be removed. If the inode is in the map then removing it does no harm. inode_remove reports if the inode was in the map and that information can be used to increment the metric if needed.

@JoukoVirtanen JoukoVirtanen force-pushed the jv-ROX-33218-instrument-inode-tracking-on-directory-being-deleted branch from 4339c06 to d35aa7c Compare April 20, 2026 18:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant