VFS hooks analysis (pass 1)

Robert Love rml at novell.com
Fri Sep 9 19:34:48 UTC 2005


On Fri, 2005-09-09 at 14:30 -0500, Timothy R. Chavez wrote:

> Technically, fsnotify is not a part of Inotify.  It's just that for the time being,
> Inotify (and dnotify), are its only users and so fsnotify only implements what
> they need.  I don't see why it'd be a problem to introduce more fsnotify
> hooks to satisfy another users needs.  Granted, these hooks would make
> use of the Inotify "handler" function, but even so, we're not altering Inotify
> in any way.  Once we have the hook in, we can wrap our code in #ifdefs,
> and delineate it from core Inotify.
> 
> Robert?

Don't see why not.

If your hooks are obviously audit hooks, maybe it makes sense to look
into doing your own auditing hook thing, but certainly if fsnotify can
satisfy your needs, then go for it.

I mean, fsnotify really is not a "thing" -- its just a header with
inlines so we don't have to duplicate hooks for both dnotify and
inotify.

	Robert Love





More information about the Linux-audit mailing list