On Thu, 2009-09-17 at 22:07 +0200, Andreas Gruenbacher wrote: > From my point of view, "global" events make no sense, and fanotify listeners > should register which directories they are interested in (e.g., include "/", > exclude "/proc"). This takes care of chroots and namespaces as well. While I completely agree that most users don't want global events, the antimalware vendors who today, unprotect and hack the syscall table on their unsuspecting customer's machines to intercept every read, write, open, close, mmap, etc syscall want EXACTLY that. They'd been asking for a way to get this information for quite some time now. The largest vendors in this market have agreed the interface (well, when it was a socket interface that I talked about for so long) should meet their needs. Subtree watching / isn't any different or better, just harder and more complex to implement. You still have to exclude /proc and /sys and everything else. Just like one must with a global listener. Still though, this sounds like an issue for the f_type and f_fsid exclusion syscall I say I'm still not settled on. Not and issue with the basis of fanotify or with the 3 proposed syscalls. Jamie, do you see a problem with what I have been asking for review on or see a problem with extending it moving forward? Linus, do you see the value of 'yet another notification scheme' ? -Eric -- To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
