source: trunk/src/sh_inotify.c@ 570

/* SAMHAIN file system integrity testing                                   */
/* Copyright (C) 2009 Rainer Wichmann                                      */
/*                                                                         */
/*  This program is free software; you can redistribute it                 */
/*  and/or modify                                                          */
/*  it under the terms of the GNU General Public License as                */
/*  published by                                                           */
/*  the Free Software Foundation; either version 2 of the License, or      */
/*  (at your option) any later version.                                    */
/*                                                                         */
/*  This program is distributed in the hope that it will be useful,        */
/*  but WITHOUT ANY WARRANTY; without even the implied warranty of         */
/*  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the          */
/*  GNU General Public License for more details.                           */
/*                                                                         */
/*  You should have received a copy of the GNU General Public License      */
/*  along with this program; if not, write to the Free Software            */
/*  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.              */

#include "config_xor.h"

#if defined(HAVE_SYS_INOTIFY_H)

#if defined(GCC_VERSION_MAJOR) && !defined(__clang__)
#if (GCC_VERSION_MAJOR > 4) || ((GCC_VERSION_MAJOR == 4) && (GCC_VERSION_MINOR > 8))
#pragma GCC diagnostic ignored "-Wclobbered"
#endif
#endif

#undef  FIL__
#define FIL__  _("sh_inotify.c")

/* printf */
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/inotify.h>
#include <errno.h>
#include <unistd.h>
#include <fcntl.h>

#include "samhain.h"
#include "sh_pthread.h"
#include "sh_calls.h"
#include "sh_inotify.h"
#include "sh_mem.h"
#include "sh_utils.h"
#include "slib.h"

/**************************************************
 *
 * Make the inotify fd thread-specific by 
 * encapsulating it in get/set functions:
 * sh_get_inotify_fd() / sh_set_inotify_fd()
 *
 **************************************************/

#if defined(HAVE_PTHREAD)

SH_MUTEX_STATIC(mutex_list_dormant, PTHREAD_MUTEX_INITIALIZER);
SH_MUTEX_STATIC(mutex_watches,      PTHREAD_MUTEX_INITIALIZER);

static pthread_key_t  inotify_key;
static pthread_once_t inotify_key_once = PTHREAD_ONCE_INIT;

static void make_inotify_key()
{
    (void) pthread_key_create(&inotify_key, free);
}

static int sh_get_inotify_fd()
{
  void * ptr;
  int  * fp;

  (void) pthread_once(&inotify_key_once, make_inotify_key);
 
  if ((ptr = pthread_getspecific(inotify_key)) == NULL) 
    {
      ptr = calloc(1,sizeof(int));
      if (ptr)
        {
          fp  = (int*) ptr;
          *fp = -1;
          (void) pthread_setspecific(inotify_key, ptr);
        }
      else
        {
          return -1;
        }
    }
  else 
    {
      fp  = (int*) ptr;
    }
  return *fp;
}

static void sh_set_inotify_fd(int fd)
{
  int  * fp;

  fp = (int*) pthread_getspecific(inotify_key);
  if (fp)
    *fp = fd;
  return;
}

/* !defined(HAVE_PTHREAD) */
#else

static int sh_inotify_fd = -1;

static inline int sh_get_inotify_fd()
{
  return sh_inotify_fd;
}

static inline void sh_set_inotify_fd(int fd)
{
  sh_inotify_fd = fd;
}

#endif

/*--- nothing thread-related below this point --- */

#include "zAVLTree.h"

typedef struct 
{
  int    watch;
  short  flag;
  short  type;
  int    class;
  int    rdepth;
  unsigned long check_flags;
  char * file;
} sh_watch;

/**************************************************
 *
 * Get inotify fd, initialize inotify if necessary
 *
 **************************************************/
#define SH_INOTIFY_FAILED -2

static int sh_inotify_getfd()
{
  int ifd = sh_get_inotify_fd();

  if (ifd >= 0)
    {
      return ifd;
    }

  else if (ifd == SH_INOTIFY_FAILED)
    {
      return -1;
    }

  else /* if (ifd == -1) */
    {
#if defined(HAVE_INOTIFY_INIT1)
      ifd = inotify_init1(IN_CLOEXEC);
#else
      ifd = inotify_init();
      if (ifd >= 0)
        {
          long sflags;

          sflags = retry_fcntl(FIL__, __LINE__, ifd, F_GETFD, 0);
          retry_fcntl(FIL__, __LINE__, ifd, F_SETFD, sflags|FD_CLOEXEC);
        }
#endif

      if (ifd < 0)
        {
          sh_set_inotify_fd(SH_INOTIFY_FAILED);
          return -1;
        }

      sh_set_inotify_fd(ifd);
      return ifd;
    }
}

/**************************************************
 *
 * Public function:
 *  int sh_inotify_wait_for_change(char * filename,
 *                                 int watch,
 *                                 int * errnum,
 *                                 int   waitsec);
 * Returns: watch, if nonnegative
 *          -1 on error or reopen required
 *             (check errnum != 0)
 *
 * Caller needs to keep track of watch descriptor
 *
 **************************************************/

#define SH_INOTIFY_REOPEN 0
#define SH_INOTIFY_MODIFY 1

void sh_inotify_init(sh_watches * watches)
{
  SH_MUTEX_LOCK_UNSAFE(mutex_watches);
  watches->list_of_watches = NULL;
  watches->count           = 0;
  watches->max_count       = 0;
  SH_MUTEX_UNLOCK_UNSAFE(mutex_watches);

  SH_MUTEX_LOCK_UNSAFE(mutex_list_dormant);
  watches->dormant_watches = NULL;
  SH_MUTEX_UNLOCK_UNSAFE(mutex_list_dormant);

  return;
}

ssize_t sh_inotify_read(char * buffer, size_t count)
{
  ssize_t len = -1;
  int     ifd = sh_inotify_getfd();

  do {
    len = read (ifd, buffer, count);
  } while (len < 0 && (errno == EINTR || errno == EAGAIN));

  return len;
}

ssize_t sh_inotify_read_timeout(char * buffer, size_t count, int timeout)
{
  ssize_t len;
  int     ifd = sh_inotify_getfd();

  len = sl_read_timeout_fd_once (ifd, buffer, count, timeout, S_FALSE);

  return len;
}


static void sh_inotify_free_watch(void * item)
{
  sh_watch * this = (sh_watch *) item;

  if (this->file)
    SH_FREE(this->file);
  SH_FREE(this);
  return;
}

static sh_watch * sh_inotify_create_watch(const char * file, 
                                          int nwatch, int flag)
{
  sh_watch * this = SH_ALLOC(sizeof(sh_watch));

  this->file  = sh_util_strdup_track(file, __FILE__, __LINE__);
  this->watch = nwatch;
  this->flag  = flag;
  return this;
}

/********** List Handling ******************/

struct sh_inotify_litem
{
  sh_watch * watch;
  struct sh_inotify_litem * next;
};

static void sh_inotify_listitem_destroy(struct sh_inotify_litem * this)
{
  if (this)
    SH_FREE(this);
  return;
}

/* No Mutex in the list cursor functions, must be in the caller
 * function...
 */
typedef struct {
  struct sh_inotify_litem *prenode;
  struct sh_inotify_litem *curnode;
} sh_inotify_listCursor;

static sh_watch * sh_inotify_list_first(sh_inotify_listCursor * listcursor, 
                                        sh_watches * watches)
{
  listcursor->prenode = watches->dormant_watches;
  listcursor->curnode = watches->dormant_watches;

  if (listcursor->curnode)
    return listcursor->curnode->watch;
  return NULL;
}

static sh_watch * sh_inotify_list_next(sh_inotify_listCursor * listcursor, 
                                       sh_watches * watches)
{
  (void) watches;

  listcursor->prenode = listcursor->curnode;

  if (listcursor->curnode)
    {
      listcursor->curnode = listcursor->curnode->next;
      if (listcursor->curnode)
        return listcursor->curnode->watch;
      else
        return NULL;
    }

  return NULL;
}

static sh_watch * sh_inotify_list_del_cur(sh_inotify_listCursor * listcursor, 
                                          sh_watches * watches)
{
  sh_watch * ret = NULL;

  if (listcursor->curnode)
    {
      struct sh_inotify_litem * this = listcursor->curnode;

      if (listcursor->prenode == this)
        {
          watches->dormant_watches = this->next;

          listcursor->prenode = watches->dormant_watches;
          listcursor->curnode = watches->dormant_watches;
        }
      else
        {
          listcursor->prenode->next = this->next;
          listcursor->curnode       = this->next;
        }
      if (listcursor->curnode)
        ret = listcursor->curnode->watch;
      else
        ret = NULL;
      sh_inotify_listitem_destroy(this);
    }
  return ret;
}

static int sh_inotify_add_dormant(sh_watches * watches, sh_watch * item)
{
  struct sh_inotify_litem * this;

  SH_MUTEX_LOCK(mutex_list_dormant);
  this = SH_ALLOC(sizeof(struct sh_inotify_litem));

  this->watch = item;
  this->next  = (struct sh_inotify_litem *) watches->dormant_watches;
  
  watches->dormant_watches = this;
  SH_MUTEX_UNLOCK(mutex_list_dormant);
  return 0;
}

static void * sh_dummy_popret = NULL;

char * sh_inotify_pop_dormant(sh_watches * watches, 
                              int * class, unsigned long * check_flags, 
                              int * type, int * rdepth)
{
  char * popret = NULL;
  struct sh_inotify_litem * this;

  /* Take the address to keep gcc from putting it into a register. 
   * Avoids the 'clobbered by longjmp' warning. 
   */
  sh_dummy_popret = (void *) &popret;

  SH_MUTEX_LOCK(mutex_list_dormant);

  this = (struct sh_inotify_litem *) watches->dormant_watches;

  if (this)
    {
      *class  = this->watch->class;
      *type   = this->watch->type;
      *rdepth = this->watch->rdepth;
      *check_flags = this->watch->check_flags;
      popret  = sh_util_strdup_track(this->watch->file, __FILE__, __LINE__);

      watches->dormant_watches = this->next;

      sh_inotify_free_watch(this->watch);
      SH_FREE(this);
    }
  SH_MUTEX_UNLOCK(mutex_list_dormant);

  sh_dummy_popret = NULL;
  return popret;
}

void sh_inotify_purge_dormant(sh_watches * watches)
{
  struct sh_inotify_litem * this;

  SH_MUTEX_LOCK(mutex_list_dormant);
  this = (struct sh_inotify_litem *) watches->dormant_watches;

  watches->dormant_watches = NULL;

  while (this)
    {
      struct sh_inotify_litem * cur = this;
      
      this = this->next;

      sh_inotify_free_watch(cur->watch);
      SH_FREE(cur);
    }
  SH_MUTEX_UNLOCK(mutex_list_dormant);
  return;
}

/********** End List Handling **************/

static zAVLKey sh_inotify_getkey(void const *item)
{
  return (&((const sh_watch *)item)->watch);
}

void sh_inotify_close()
{
  int     ifd = sh_inotify_getfd();

  if (ifd >= 0)
    close(ifd);
  sh_set_inotify_fd(-1);

  return;
}

  
/* This function removes all watches from the list,
 * and closes the inode file descriptor in this thread.
 */
void sh_inotify_remove(sh_watches * watches)
{
  zAVLTree   * all_watches;

  SH_MUTEX_LOCK(mutex_watches);
  all_watches = (zAVLTree *)(watches->list_of_watches);

  if (all_watches)
    zAVLFreeTree(all_watches, sh_inotify_free_watch);

  watches->list_of_watches = NULL;
  watches->count = 0;
  SH_MUTEX_UNLOCK(mutex_watches);

  sh_inotify_close();
  return;
}

static int index_watched_file(char * filename, sh_watches * watches)
{
  sh_watch   * item;
  zAVLCursor   avlcursor;
  zAVLTree   * all_watches = (zAVLTree *)(watches->list_of_watches);

  if (all_watches)
    {
      for (item = (sh_watch *) zAVLFirst(&avlcursor, all_watches); item;
           item = (sh_watch *) zAVLNext(&avlcursor))
        {
          if (item->file)
            {
              if (0 == strcmp(filename, item->file))
                return item->watch;
            }
        }
    }
  return -1;
}

#if !defined(IN_DONT_FOLLOW)
#define IN_DONT_FOLLOW 0
#endif

#define SH_INOTIFY_FILEFLAGS \
  (IN_ATTRIB|IN_MODIFY|IN_DELETE_SELF|IN_MOVE_SELF|IN_UNMOUNT|IN_DONT_FOLLOW)
#define SH_INOTIFY_DIRFLAGS \
  (SH_INOTIFY_FILEFLAGS|IN_DELETE|IN_CREATE|IN_MOVED_FROM|IN_MOVED_TO)

#define SH_INOTIFY_FLAGS (SH_INOTIFY_FILEFLAGS|SH_INOTIFY_DIRFLAGS)


/* Create an item and put it on the 'dormant' list for later watch creation 
 */
int sh_inotify_add_watch_later(const char * filename, sh_watches * watches, 
                               int * errnum,
                               int class, unsigned long check_flags, int type, 
                               int rdepth)
{
  sh_watch   * item;

  item = sh_inotify_create_watch(filename, -1, /* flag */ 0);

  item->class      = class;
  item->type       = (short) type;
  item->rdepth     = (short) rdepth;
  item->check_flags = check_flags;

  sh_inotify_add_dormant(watches, item);
  if (errnum)
    *errnum = 0;

  return 0;
}
          
int sh_inotify_rm_watch (sh_watches * watches, sh_watches * save, int wd)
{
  int ifd = sh_get_inotify_fd();

  if (watches)
    {
      sh_watch   * item;
  
      SH_MUTEX_LOCK(mutex_watches);
      item = zAVLSearch(watches->list_of_watches, &wd);
      
      if (item)
        {
          zAVLDelete(watches->list_of_watches, &wd);
          if (save) /* optionally save the item */
            {
              item->watch = -1;
              sh_inotify_add_dormant(save, item);
            }
          else
            {
              sh_inotify_free_watch(item);
            }
        }
      SH_MUTEX_UNLOCK(mutex_watches);
    }
  return inotify_rm_watch(ifd, wd);
}

#if (defined(SH_WITH_CLIENT) || defined(SH_STANDALONE)) 
static void * sh_dummy_litem;

int sh_inotify_recheck_watches (sh_watches * watches, sh_watches * save)
{
  sh_watch   * litem;
  sh_inotify_listCursor listcursor;
  int ifd = sh_get_inotify_fd();

  extern void sh_fInotify_report_add(char * path, 
                                     int class, unsigned long check_flags);

  sh_dummy_litem = (void*) &litem;

  /* -- Check dormant watches for reopening.
   */
  SH_MUTEX_LOCK(mutex_list_dormant);
  
  litem = sh_inotify_list_first(&listcursor, save);

  while (litem)
    {
    have_next:

      /* sh_inotify_list_del_cur may return NULL */
      if (litem && litem->file && litem->watch == -1)
        {
          litem->watch = inotify_add_watch (ifd, litem->file, 
                                            SH_INOTIFY_FLAGS);
          
          if (litem->watch >= 0)
            {
              SH_MUTEX_LOCK(mutex_watches);
              if (watches->list_of_watches)
                zAVLInsert(watches->list_of_watches, litem);
              SH_MUTEX_UNLOCK(mutex_watches);

              sh_fInotify_report_add(litem->file, litem->class, litem->check_flags);

              litem = sh_inotify_list_del_cur(&listcursor, save);
              
              goto have_next;
            }
        }
      litem = sh_inotify_list_next(&listcursor, save);
    }
  SH_MUTEX_UNLOCK(mutex_list_dormant);
  return 0;
}
#endif

/* This function is idempotent; it will add the watch only once 
 */
int sh_inotify_add_watch(char * filename, sh_watches * watches, int * errnum,
                         int class, unsigned long check_flags, int type, int rdepth)
{
  volatile int retval = 0;

  SH_MUTEX_LOCK(mutex_watches);

  *errnum = 0;

  if (filename)
    {
      int nwatch;
      sh_watch   * item;
      int index = index_watched_file(filename, watches);
      
      if (index < 0)
        {
          int     ifd = sh_inotify_getfd();

          /*************************************

          if (watches->count == SH_INOTIFY_MAX)
            {
#ifdef EMFILE
              *errnum = EMFILE;
#else
              *errnum = 24;
#endif
              return -1;
            }
          **************************************/

          nwatch = inotify_add_watch (ifd, filename, 
                                      SH_INOTIFY_FLAGS);
          if (nwatch < 0)
            {
              *errnum = errno;
              retval = -1;
              goto retpoint;
            }

          item = sh_inotify_create_watch(filename, nwatch, /* flag */ 0);

          item->class      = class;
          item->type       = type;
          item->rdepth     = rdepth;
          item->check_flags = check_flags;
          
          if (NULL == watches->list_of_watches)
            watches->list_of_watches = zAVLAllocTree (sh_inotify_getkey, 
                                                      zAVL_KEY_INT);
 
          if (watches->list_of_watches)
            {
              *errnum =  zAVLInsert((zAVLTree *)(watches->list_of_watches), 
                                    item);

              if (*errnum != 0)
                {
                  /* zAVLInsert returns -1 on malloc() error and 3 if
                   * the node already exists. 
                   */
                  *errnum = (*errnum == -1) ? ENOMEM : EEXIST;
                  sh_inotify_free_watch(item);
                  retval = -1;
                  goto retpoint;
                }
            }
          else
            {
              *errnum = ENOMEM;
              sh_inotify_free_watch(item);
              retval = -1;
              goto retpoint;
            }

          ++(watches->count);
        }
      else if (type == SH_INOTIFY_DIR) /* watch exists */
        {
          /* This covers the case that a directory has been added,
           * but is watched as file at first because it is also
           * specified as file in the config.
           */
          item = zAVLSearch(watches->list_of_watches, &index);

          if (item && item->type == SH_INOTIFY_FILE)
            {
              item->type = SH_INOTIFY_DIR;
            }
        }
    }
 retpoint:
  ; /* 'label at end of compound statement' */
  SH_MUTEX_UNLOCK(mutex_watches);
  return retval;
}

static void * sh_dummy_sret = NULL;

char * sh_inotify_search_item(sh_watches * watches, int watch, 
                              int * class, unsigned long * check_flags, 
                              int * type, int * rdepth)
{
  sh_watch * item;
  char     * sret = NULL;

  /* Take the address to keep gcc from putting it into a register. 
   * Avoids the 'clobbered by longjmp' warning. 
   */
  sh_dummy_sret = (void *) &sret;

  SH_MUTEX_LOCK(mutex_watches);
  item = zAVLSearch(watches->list_of_watches, &watch);

  if (item)
    {
      *class      = item->class;
      *check_flags = item->check_flags;
      *type       = item->type;
      *rdepth     = item->rdepth;
      sret = sh_util_strdup_track(item->file, __FILE__, __LINE__);
    }
  SH_MUTEX_UNLOCK(mutex_watches);
  return sret;
}

static void * sh_dummy_litem = NULL;

int sh_inotify_wait_for_change(char * filename, sh_watches * watches, 
                               int  * errnum, int waitsec)
{
  sh_watch   * litem;
  sh_watch   * zitem;
  int          ifd = sh_inotify_getfd();

  /* Take the address to keep gcc from putting it into a register. 
   * Avoids the 'clobbered by longjmp' warning. 
   */
  sh_dummy_litem = (void*) &litem;

  *errnum = 0;

 start_it:

  if (ifd >= 0)
    {
      volatile ssize_t  i  = 0;
      ssize_t len = -1;
      int  flag = 0;
      char buffer[1024];

      sh_inotify_listCursor listcursor;

      /* -- Add watch if required 
       */
      if (filename)
        {
          if (sh_inotify_add_watch(filename, watches, errnum, 
                                   0, 0, SH_INOTIFY_FILE, 0) < 0)
            {
              retry_msleep(waitsec, 0);
              return -1;
            }
        }

      /* -- Check dormant watches for reopening.
       */
      SH_MUTEX_LOCK(mutex_list_dormant);

      for (litem = sh_inotify_list_first(&listcursor, watches); litem;
           litem = sh_inotify_list_next(&listcursor, watches))
        {
        have_next:
          /* sh_inotify_list_del_cur may return NULL */
          if (litem && litem->file && litem->watch == -1)
            {
              litem->watch = inotify_add_watch (ifd, litem->file, 
                                                SH_INOTIFY_FLAGS);

              if (litem->watch >= 0)
                {
                  SH_MUTEX_LOCK(mutex_watches);
                  if (watches->list_of_watches)
                    zAVLInsert(watches->list_of_watches, litem);
                  SH_MUTEX_UNLOCK(mutex_watches);
                  litem = sh_inotify_list_del_cur(&listcursor, watches);
                  goto have_next;
                }
            }
        }
      SH_MUTEX_UNLOCK(mutex_list_dormant);


      /* -- Blocking read on inotify file descriptor
       */
      len = sh_inotify_read(buffer, sizeof(buffer));

      if (len > 0)
        {
          struct inotify_event *event;

          i = 0;
          
          while (i < len) {

            event = (struct inotify_event *) &buffer[i];

            SH_MUTEX_LOCK(mutex_watches);
            zitem = zAVLSearch(watches->list_of_watches, &(event->wd));

            if (zitem)
              {
                if (event->mask & IN_MODIFY)
                  {
                    zitem->flag |= SH_INOTIFY_MODIFY;
                    flag |= SH_INOTIFY_MODIFY;
                  }
                else if (event->mask & IN_DELETE_SELF || 
                         event->mask & IN_UNMOUNT     || 
                         event->mask & IN_MOVE_SELF   )
                  {
                    zitem->flag |= SH_INOTIFY_REOPEN;
                    (void) inotify_rm_watch(ifd, zitem->watch);
                    zAVLDelete(watches->list_of_watches, zitem);
                    sh_inotify_add_dormant(watches, zitem);
                    zitem->watch    = -1;
                    flag |= SH_INOTIFY_REOPEN;
                  }
              }
            SH_MUTEX_UNLOCK(mutex_watches);
            
            i += sizeof (struct inotify_event) + event->len;
          }
        }
      else if (len == -1)
        {
          *errnum = errno;
          retry_msleep(waitsec, 0);

          return -1;
        }

      if (flag & SH_INOTIFY_REOPEN)
        {
          if (flag & SH_INOTIFY_MODIFY)
            return 0;
          else
            goto start_it;
        }

      return 0;
    }

  /* Inotify not working, sleep
   */
  retry_msleep(waitsec, 0);

  *errnum = 0;
  return -1;
}


/* !defined(HAVE_SYS_INOTIFY_H) */
#else

#include "sh_calls.h"
#include "sh_inotify.h"

void sh_inotify_remove(sh_watches * watches)
{
  (void) watches;
  return;
}

int sh_inotify_wait_for_change(char * filename, sh_watches * watches,
                               int *  errnum, int waitsec)
{
  (void) filename;
  (void) watches;

  /* Inotify not working, sleep for waitsec seconds
   */
  retry_msleep(waitsec, 0);

  if (errnum)
    *errnum = 0;
  return -1;
}

int sh_inotify_add_watch(char * filename, sh_watches * watches, int  * errnum,
                         int class, unsigned long check_flags, int type, int rdepth)
{
  (void) filename;
  (void) watches;
  (void) class;
  (void) check_flags;
  (void) type;
  (void) rdepth;

  if (errnum)
    *errnum = 0;
  return 0;
}

int sh_inotify_add_watch_later(const char * filename, sh_watches * watches, 
                               int  * errnum,
                               int class, unsigned long check_flags, int type, int rdepth)
{
  (void) filename;
  (void) watches;
  (void) class;
  (void) check_flags;
  (void) type;
  (void) rdepth;

  if (errnum)
    *errnum = 0;
  return 0;
}

#endif

#ifdef SH_CUTEST
#include "CuTest.h"
void Test_inotify(CuTest *tc) {
#if defined(HAVE_SYS_INOTIFY_H) && (defined(SH_WITH_CLIENT) || defined(SH_STANDALONE))

  int          ret;
  sh_watches   twatch = SH_INOTIFY_INITIALIZER;
  sh_watch   * litem;
  sh_inotify_listCursor listcursor;
  char * p;
  int class;
  int type;
  int rdepth;
  unsigned long check_flags;
  int           nrun = 0;

  sh_watch aw1 = { -1, 0, 0, 1, 99, 1, "a1" };
  sh_watch aw2 = { -1, 0, 0, 2, 99, 1, "a2" };
  sh_watch aw3 = {  2, 0, 0, 3, 99, 1, "a3" };
  sh_watch aw4 = { -1, 0, 0, 4, 99, 1, "a4" };
  sh_watch aw5 = {  5, 0, 0, 5, 99, 1, "a5" };

  do {

    int          count = 0;

    sh_watch * w1 = SH_ALLOC(sizeof(sh_watch));
    sh_watch * w2 = SH_ALLOC(sizeof(sh_watch));
    sh_watch * w3 = SH_ALLOC(sizeof(sh_watch));
    sh_watch * w4 = SH_ALLOC(sizeof(sh_watch));
    sh_watch * w5 = SH_ALLOC(sizeof(sh_watch));

    memcpy(w1, &aw1, sizeof(sh_watch));
    w1->file = sh_util_strdup(aw1.file);
    memcpy(w2, &aw2, sizeof(sh_watch));
    w2->file = sh_util_strdup(aw2.file);
    memcpy(w3, &aw3, sizeof(sh_watch));
    w3->file = sh_util_strdup(aw3.file);
    memcpy(w4, &aw4, sizeof(sh_watch));
    w4->file = sh_util_strdup(aw4.file);
    memcpy(w5, &aw5, sizeof(sh_watch));
    w5->file = sh_util_strdup(aw5.file);
    
    ret = sh_inotify_add_dormant(&twatch, w1);
    CuAssertIntEquals(tc, ret, 0);
    ret = sh_inotify_add_dormant(&twatch, w2);
    CuAssertIntEquals(tc, ret, 0);
    ret = sh_inotify_add_dormant(&twatch, w3);
    CuAssertIntEquals(tc, ret, 0);
    ret = sh_inotify_add_dormant(&twatch, w4);
    CuAssertIntEquals(tc, ret, 0);
    ret = sh_inotify_add_dormant(&twatch, w5);
    CuAssertIntEquals(tc, ret, 0);
    
    /* -- Check dormant watches for reopening.
     */
    for (litem = sh_inotify_list_first(&listcursor, &twatch); litem;
         litem = sh_inotify_list_next(&listcursor, &twatch))
      {
      have_next:
        
        /* sh_inotify_list_del_cur may return NULL */
        if (litem)
          {
            ++count;
            
            if (litem->file && litem->watch == -1)
              {
                
                switch (litem->class)
                  {
                  case 1:
                    CuAssertStrEquals(tc, litem->file, "a1");
                    break;
                  case 2:
                    CuAssertStrEquals(tc, litem->file, "a2");
                    break;
                  case 3:
                    CuAssertStrEquals(tc, litem->file, "deadbeef");
                    break;
                  case 4:
                    CuAssertStrEquals(tc, litem->file, "a4");
                    break;
                  case 5:
                    CuAssertStrEquals(tc, litem->file, "deadbeef");
                    break;
                  default:
                    CuAssertStrEquals(tc, litem->file, "deadbeef");
                  }
                litem = sh_inotify_list_del_cur(&listcursor, &twatch);
                goto have_next;
              }
            switch (litem->class)
              {
              case 3:
                CuAssertStrEquals(tc, litem->file, "a3");
                break;
              case 5:
                CuAssertStrEquals(tc, litem->file, "a5");
                break;
              default:
                CuAssertStrEquals(tc, litem->file, "foobar");
              }      
          }
      }
    
    CuAssertIntEquals(tc, count, 5);
    
    p = sh_inotify_pop_dormant(&twatch, &class, &check_flags, &type, &rdepth);
    CuAssertStrEquals(tc, p, "a5");
    
    p = sh_inotify_pop_dormant(&twatch, &class, &check_flags, &type, &rdepth);
    CuAssertStrEquals(tc, p, "a3");
    CuAssertIntEquals(tc, class, 3);
    
    p = sh_inotify_pop_dormant(&twatch, &class, &check_flags, &type, &rdepth);
    CuAssertTrue(tc, NULL == p);
    CuAssertTrue(tc, NULL == twatch.dormant_watches);

    ++nrun;

  } while (nrun < 100);

#else
  (void) tc;
#endif

  return;
}
#endif