As it stands, fanotify reports the process ID of the file that is being
operated on:
struct fanotify_event_metadata {
__u32 event_len;
__u8 vers;
__u8 reserved;
__u16 metadata_len;
__aligned_u64 mask;
__s32 fd;
__s32 pid;
};
One nasty problem with this is that the process often is long gone by
the time the notification arrives.
Would it be possible to amend this format with:
__s32 pidfd;
It would hold the pid still for the duration of notification processing
and allow for the fanotify monitor to safely use the pid field to
inspect /proc/<pid>.
And the possibility of sending signals to the monitored process might
come in handy as well.
Thinking about this a bit more, could the fd field take on the dual role
of allowing you to read the file in question as well as acting as a
pidfd?
Marko
