Re: [PATCH] inotify: Added pid and uid information in inotify event.

[Amir Goldstein]

On Mon, Jul 8, 2024 at 1:13 PM lizhigang <lizhigang.1220@xxxxxxxxxxxxx> wrote:
>
> The inotify event only contains file name information. Sometimes we
> also want to know user or process information,such as who created
> or deleted a file. This patch adds information such as COMM, PID
> and UID to the end of filename, which allowing us to implement
> this function without modifying the current Inotify mechanism.
>
> This function is not enabled by default and is enabled through an IOCTL
>
> When enable this function, inotify_event->name will contain comm,
> pid and uid information, with the following specific format:
>
> filename____XXX,pid:YYY__uid:ZZZ
>
> Pseudo code to enable this function:
> int rc, bytes_to_read, inotify_fd;
>
> inotify_fd = inotify_init();
> ...
> // enable padding uid,pid information
> rc = ioctl( inotify_fd, TIOCLINUX, &bytes_to_read);
>
> Log example with this function:
> CREATE,ISDIR /home/peter/testdir____mkdir,pid:3626__uid:1000
> CREATE /home/peter/test.txt____bash,pid:3582__uid:1000
> OPEN /home/peter/test.txt____bash,pid:3582__uid:1000
> MODIFY /home/peter/test.txt____bash,pid:3582__uid:1000
> CLOSE_WRITE,CLOSE /home/peter/test.txt____bash,pid:3582__uid:1000
> OPEN,ISDIR /home/peter/testdir____rm,pid:3640__uid:1000
> ACCESS,ISDIR /home/peter/testdir____rm,pid:3640__uid:1000
> ACCESS,ISDIR /home/peter/testdir____rm,pid:3640__uid:1000
> CLOSE_NOWRITE,CLOSE,ISDIR /home/peter/testdir____rm,pid:3640__uid:1000
> DELETE,ISDIR /home/peter/testdir____rm,pid:3640__uid:1000
>

Please take a look at https://man7.org/linux/man-pages/man7/fanotify.7.html

It already reports pid and the event format already supports info extensions,
so adding uid would be easy (opt-in not via ioctl but via
fanotify_init() flags),
if you can justify the use case for this feature.

There are still some differences between inotify and fanotify that
could make people want to use inotify, but generally, I would not like
to extend inotify API like this.

Thanks,
Amir.