LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Kernel (https://www.linuxquestions.org/questions/linux-kernel-70/)
-   -   fanotify howto?: recursive mark, directory changes (https://www.linuxquestions.org/questions/linux-kernel-70/fanotify-howto-recursive-mark-directory-changes-918231/)

Meson 12-11-2011 04:34 PM

fanotify howto?: recursive mark, directory changes
 
First of all, I have been under the impression that fanotify can serve as a complete replacement for inotify (because I believe inotify actually uses fanotify as its backend now). Please correct me if I'm wrong.

I'm having trouble doing two things.

1) Recursively watching an entire tree. Is this possible? Or do I have to start with a directory and manually apply marks to all descendent directories.

2) I'm having trouble seeing file creation/deletion on a directory. For a file creation I see an open/close for the file itself, sometimes grouped in a single event. But I never see it with respect to the directory. So file deletions are aren't noticed at all.

What I'm really after here is being able to see a file move. Is this possible?

Thanks!

Nominal Animal 12-11-2011 06:02 PM

Quote:

Originally Posted by Meson (Post 4547439)
First of all, I have been under the impression that fanotify can serve as a complete replacement for inotify (because I believe inotify actually uses fanotify as its backend now). Please correct me if I'm wrong.

Well, not really wrong. Both inotify and fanotify use fsnotify as their backend. fanotify is only available in kernels 2.6.37 and later. They seem to support different feature sets, so I wouldn't say one replaces the other.

Quote:

Originally Posted by Meson (Post 4547439)
1) Recursively watching an entire tree. Is this possible? Or do I have to start with a directory and manually apply marks to all descendent directories.

You can watch an entire mount point, using FAN_MARK_MOUNT (and add ignore marks to directories you are not interested in).

Quote:

Originally Posted by Meson (Post 4547439)
So file deletions are aren't noticed at all.

Dammit, you're right. File replacement or deletion is not caught at all, not even using the FAN_OPEN_PERM | FAN_ACCESS_PERM marks (using FAN_CLASS_CONTENT or FAN_CLASS_PRE_CONTENT). Neither is subdirectory creation, renaming, or deletion!

This is definitely unsatisfactory. Fanotify as it is right now is only useful for file scanners. I was hoping to use it to control and monitor access to configuration files (storing changesets and identifying the original user, without user interaction). I would have liked to get synchronous CLOSE_WRITEs (that block the close() until a response is given), but subdirectory and deletion and rename events are absolutely necessary for fanotify to be really useful.

By the way, this is my 999th post ;)

Meson 12-11-2011 06:22 PM

Ah, fsnotify, that's what I was thinking. It'd be nice if fanotify was inotify+blocking =). Oh well, I don't need blocking so I guess inotify is what I want. I'm better off anyway because there's far more information out there about it.


All times are GMT -5. The time now is 06:29 AM.