8 ms·

This seems a little roundabout. Why is this preferable over using `inotify(7)`? That's an existing system which can notify your userspace driver program about a

This seems a little roundabout. Why is this preferable over using `inotify(7)`? That's an existing system which can notify your userspace driver program about any time `setxattr(2)` is called. I get that it's fun to experiment with BPF, but it's also useful to see how many tools already exist. BPF is powerful, yes - maybe too powerful, and it's often not the best tool for the job.

derobert 4y ago
Here you probably want fanotify, not inotify. The later would require setting up a lot of inotify entries, recursing through the filesystem. https://man7.org/linux/man-pages/man7/fanotify.7.html https://man7.org/linux/man-pages/man7/fanotify.7.html I think fanotify does xattrs, but I haven't tested.
- javierhonduco 4y ago
  Exactly this. I should have mentioned it in the post. Might amend it. Would be interesting to compare the chances of race conditions with inotify vs BPF for this contrived use-case.
  - ec109685 4y ago
    Just curious why you wouldn’t amend it? Doesn’t take away from the original point that bpf is cool.
    - OJFord 4y ago
      Because it's from 2020/21, not even like it's a factual error, and OP may not have the interest to revisit it?
- patrakov 4y ago
  I would still think that eBPF is a better suited approach. With fanotify, you would need to manage the mount points for which notifications need to be received. This works semi-OK for a static use case, but not for dynamically-created mounts and, worse, mount namespaces. In other words, fanotify is not suitable at all, without a lot of glue, for monitoring events happening in containers. And, for example, clamonacc (on-access file checking for ClamAV) does not work with removable storage, temporary network mounts, and containers for this very reason.