4 ms·
Another Linux file notification subsystem
From the article: a new notification system, sorta like inotify, only instead of an
arbitrary 'watch descriptor' which userspace has to know how to map back
to an object on the filesystem, fanotify provides an open read-only fd
back to the original object.
- nailer 17y agoWhile it's not designed to be post game-over security software itself - as the author states - it's primarily designed to support post game-over security scanning software, which seems like a poor motivator to include it in the Linux kernel. A better solution to this problem would be: * user education about why these solutions don't work * ensure binaries and scripts are either signed or created locally * ensure analysis is done from trusted environments (eg, another OS connected to the same SAN you're booting the suspect machine from).
- jcapote 17y agoWhat's wrong with ionotify?