Re: [RFC][PATCH 0/7] fanotify: add support for more events

Amir Goldstein
2016-12-09T09:14:15Z

On Thu, Oct 13, 2016 at 9:42 PM, Amir Goldstein <amir73il@gmail.com> wrote:
> On Thu, Oct 13, 2016 at 8:35 PM, Marko Rauhamaa
> <marko.rauhamaa@f-secure.com> wrote:
>>
>> Amir Goldstein:
>>> This series is a prep work for using fanotify to monitor all events in
>>> a file system with a single watch.
>>>
>>> [...]
>>>
>>> I am posting this WIP to get feedback on the idea and to find out if
>>> there are any users out there interested in the improved fanotify
>>> capabilities and/or in the super block monitoring use case.
>>
>> My employer certainly is in need of monitoring a whole filesystem. We
>> have noticed that namespaces evade monitoring via FAN_MARK_MOUNT. I was
>> thinking something like a FAN_MARK_FILESYSTEM would be needed.
>>
>
> I have a POC of monitoring entire file system, while filtering to namespace
> only the events that should be visible to its mounts.
> I need to get the patches into shape and shake them a bit, then
> I will post them and I am hoping that others could test them for their
> use case as well.
>

Marko,

The super block watch patches are available on my git tree at:
https://github.com/amir73il/linux/commits/fanotify_sb-4.9

I won't bother to post them to the list unless someone shows interest.
Note that beyond the ability to watch a file system, they also
provide all the legacy intotify events (create/remove), so maybe
that's also useful to you guys.

Anyway, if you are interested and willing to give them a try
please send me feedback.

Thanks,
Amir.