0

dear linux C programmers:

in the linux fanotify facility, I know how to monitor for file opens (FAN_OPEN). I can also learn whether the open was a 'read' or 'write' if I monitor until the close, because there is a FAN_CLOSE_WRITE and a FAN_CLOSE_NOWRITE.

I always thought that it would be at open() time that one tells POSIX whether the file is opened for read/write, so that the fanotify would let me distinguish between them at the open time, not at the close time. I must be wrong here.

am I? why?

/iaw

ivo Welch
  • 2,427
  • 2
  • 23
  • 31

1 Answers1

1

According to fanotify_mark(2), the event indicates the type of file that is being closed:

FAN_CLOSE_WRITE Create an event when a writable file is closed.

FAN_CLOSE_NOWRITE Create an event when a read-only file or directory is closed.

In your fanotify_mark(2) call, you need to express interest in FAN_MODIFY events. If the file is modified, you will be notified. There does not appear to be a way to know that a file was opened with write intent. Only when the file is actually modified will you be notified.

user590028
  • 11,364
  • 3
  • 40
  • 57