On Mon, Jul 8, 2024 at 1:13 PM lizhigang <lizhigang.1220@xxxxxxxxxxxxx> wrote: > > The inotify event only contains file name information. Sometimes we > also want to know user or process information,such as who created > or deleted a file. This patch adds information such as COMM, PID > and UID to the end of filename, which allowing us to implement > this function without modifying the current Inotify mechanism. > > This function is not enabled by default and is enabled through an IOCTL > > When enable this function, inotify_event->name will contain comm, > pid and uid information, with the following specific format: > > filename____XXX,pid:YYY__uid:ZZZ > > Pseudo code to enable this function: > int rc, bytes_to_read, inotify_fd; > > inotify_fd = inotify_init(); > ... > // enable padding uid,pid information > rc = ioctl( inotify_fd, TIOCLINUX, &bytes_to_read); > > Log example with this function: > CREATE,ISDIR /home/peter/testdir____mkdir,pid:3626__uid:1000 > CREATE /home/peter/test.txt____bash,pid:3582__uid:1000 > OPEN /home/peter/test.txt____bash,pid:3582__uid:1000 > MODIFY /home/peter/test.txt____bash,pid:3582__uid:1000 > CLOSE_WRITE,CLOSE /home/peter/test.txt____bash,pid:3582__uid:1000 > OPEN,ISDIR /home/peter/testdir____rm,pid:3640__uid:1000 > ACCESS,ISDIR /home/peter/testdir____rm,pid:3640__uid:1000 > ACCESS,ISDIR /home/peter/testdir____rm,pid:3640__uid:1000 > CLOSE_NOWRITE,CLOSE,ISDIR /home/peter/testdir____rm,pid:3640__uid:1000 > DELETE,ISDIR /home/peter/testdir____rm,pid:3640__uid:1000 > Please take a look at https://man7.org/linux/man-pages/man7/fanotify.7.html It already reports pid and the event format already supports info extensions, so adding uid would be easy (opt-in not via ioctl but via fanotify_init() flags), if you can justify the use case for this feature. There are still some differences between inotify and fanotify that could make people want to use inotify, but generally, I would not like to extend inotify API like this. Thanks, Amir.
