From f29f61e646916dbc6f8dc98c4025671c855e8a36 Mon Sep 17 00:00:00 2001 From: Adrian Serrano Date: Fri, 27 Apr 2018 03:57:58 +0200 Subject: [PATCH] Disable fsnotify recursive test under Darwin (#6962) A race has been discovered in the kqueue implementation of fsnotify which causes installation of a watch to a subdirectory of an already watched directory to fail occasionally. Disabled the test because Auditbeat doesn't use fsnotify under Darwin, so there is no point on testing it anyway. From an initial investigation it resulted that sometimes a directory creation event from the kernel is received twice. In Auditbeat, we react to the first one by adding a watch to the directory. Once the second event arrives, fsnotify overwrites the watch with an internal one, as it needs to install a watch on every file and directory it monitors. --- auditbeat/module/file_integrity/monitor/monitor_test.go | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/auditbeat/module/file_integrity/monitor/monitor_test.go b/auditbeat/module/file_integrity/monitor/monitor_test.go index 422340d2ce5..0c4050d59eb 100644 --- a/auditbeat/module/file_integrity/monitor/monitor_test.go +++ b/auditbeat/module/file_integrity/monitor/monitor_test.go @@ -56,6 +56,14 @@ func TestNonRecursive(t *testing.T) { } func TestRecursive(t *testing.T) { + if runtime.GOOS == "darwin" { + // This test races on Darwin because internal races in the kqueue + // implementation of fsnotify when a watch is added in response to + // a subdirectory created inside a watched directory. + // This race doesn't affect auditbeat because the file_integrity module + // under Darwin uses fsevents instead of kqueue. + t.Skip("Disabled on Darwin") + } dir, err := ioutil.TempDir("", "monitor") assertNoError(t, err) // under macOS, temp dir has a symlink in the path (/var -> /private/var)