full-disclosure - Re: About the inotify Mechanism in LINUX

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed, 07 Jul 2010 08:04:54 -0400
From: Valdis.Kletnieks@...edu
To: supercodeing35271 supercodeing35271 <supercodeing35271@...il.com>
Cc: Full-Disclosure@...ts.grok.org.uk
Subject: Re: About the inotify Mechanism in LINUX

On Wed, 07 Jul 2010 15:42:08 +0800, supercodeing35271 supercodeing35271 said:
> I am now thinking on monitor the filesystem in linux, for this reason
> the inotify is a good way.But the problem is that what i want to do is
> not only monitor but a handle.This situation is like that a file in
> system has been changed unusually,now the inotity could tell me this
> but i want to intercept the change before the file been changed.
> So does anyone could give me a help on HOWTO?

Eric Paris's fanotify patches look likely to make an appearance in the 2.6.36
kernel:

config FANOTIFY
        bool "Filesystem wide access notification"
        select FSNOTIFY
        select ANON_INODES
        default y
        ---help---
           Say Y here to enable fanotify suport.  fanotify is a file access
           notification system which differs from inotify in that it sends
           and open file descriptor to the userspace listener along with
           the event.

           If unsure, say Y.

config FANOTIFY_ACCESS_PERMISSIONS
        bool "fanotify permissions checking"
        depends on FANOTIFY
        depends on SECURITY
        default n
        ---help---
           Say Y here is you want fanotify listeners to be able to make permissions
           decisions concerning filesystem events.  This is used by some fanotify
           listeners which need to scan files before allowing the system access to
           use those files.  This is used by some anti-malware vendors and by some
           hierarchical storage managent systems.

           If unsure, say N.

Is that what you're looking for?

Content of type "application/pgp-signature" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/