lkml.org 
[lkml]   [2009]   [Sep]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRe: fanotify as syscalls
    From
    Date
    On Thu, 2009-09-17 at 22:07 +0200, Andreas Gruenbacher wrote:

    > From my point of view, "global" events make no sense, and fanotify listeners
    > should register which directories they are interested in (e.g., include "/",
    > exclude "/proc"). This takes care of chroots and namespaces as well.

    While I completely agree that most users don't want global events, the
    antimalware vendors who today, unprotect and hack the syscall table on
    their unsuspecting customer's machines to intercept every read, write,
    open, close, mmap, etc syscall want EXACTLY that. They'd been asking
    for a way to get this information for quite some time now. The largest
    vendors in this market have agreed the interface (well, when it was a
    socket interface that I talked about for so long) should meet their
    needs.

    Subtree watching / isn't any different or better, just harder and more
    complex to implement. You still have to exclude /proc and /sys and
    everything else. Just like one must with a global listener. Still
    though, this sounds like an issue for the f_type and f_fsid exclusion
    syscall I say I'm still not settled on. Not and issue with the basis of
    fanotify or with the 3 proposed syscalls.

    Jamie, do you see a problem with what I have been asking for review on
    or see a problem with extending it moving forward?

    Linus, do you see the value of 'yet another notification scheme' ?

    -Eric



    \
     
     \ /
      Last update: 2009-09-18 22:55    [W:4.081 / U:0.664 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site