Module low_level

Structs

FanotifyEventMetadata

FanotifyResponse

It is used to control file access.

Constants

AT_EMPTY_PATH

AT_FDCWD

AT_NO_AUTOMOUNT

AT_REMOVEDIR

AT_SYMLINK_FOLLOW

AT_SYMLINK_NOFOLLOW

FANOTIFY_METADATA_VERSION

This const is used to be compared to vers field of FanotifyEventMetadata to verify that the structures returned at run time match the structures defined at compile time.

FAN_ACCESS

Create an event when a file or directory is accessed (read).

FAN_ACCESS_PERM

Create an event when a permission to read a file or directoryis requested.
An fanotify file descriptor created with FAN_CLASS_PRE_CONTENT or FAN_CLASS_CONTENT is required.

FAN_ALLOW

Allow the file operation.

FAN_ATTRIB

Create an event when a metadata changed.

FAN_AUDIT

bit mask to create audit record for result

FAN_CLASS_CONTENT

This value allows the receipt of events notifying that a file has been accessed and events for permission decisions if a file may be accessed.

FAN_CLASS_NOTIF

This is the default value. It does not need to be specified.

FAN_CLASS_PRE_CONTENT

This value allows the receipt of events notifying that a file has been accessed and events for permission decisions if a file may be accessed.
It is intended for event listeners that need to access files before they contain their final data.
This notification class might be used by hierarchical storage managers, for example.

FAN_CLOEXEC

Set the close-on-exec flag (FD_CLOEXEC) on the new file descriptor.

FAN_CLOSE

A file is closed (FAN_CLOSE_WRITE|FAN_CLOSE_NOWRITE).

FAN_CLOSE_NOWRITE

Create an event when a read-only file or directory is closed.

FAN_CLOSE_WRITE

Create an event when a writable file is closed.

FAN_CREATE

Create an event when a file created

FAN_DELETE

Create an event when a file deleted

FAN_DELETE_SELF

Create an event when a self was deleted

FAN_DENY

Deny the file operation.

FAN_ENABLE_AUDIT

CONFIG_AUDIT_SYSCALL

FAN_EVENT_ON_CHILD

Events for the immediate children of marked directories shall be created.

FAN_MARK_ADD

The events in mask will be added to the mark mask (or to the ignore mask). mask must be nonempty or the error EINVAL will occur.

FAN_MARK_DONT_FOLLOW

If pathname is a symbolic link, mark the link itself, rather than the file to which it refers.
(By default,fanotify_mark() dereferences pathname if it is a symbolic link.)

FAN_MARK_FILESYSTEM

Mark the filesystem specified by pathname.
The filesystem containing pathname will be marked.
All the contained files and directories of the filesystem from any mount point will be monitored.

FAN_MARK_FLUSH

Remove either all marks for filesystems, all marks for mounts,or all marks for directories and files from the fanotify group.
If flags contains FAN_MARK_MOUNT, all marks for mounts are removed from the group.
If flags contains FAN_MARK_FILESYSTEM, all marks for filesystems are removed from the group.
Otherwise, all marks for directories and files are removed.
No flag other than and at most one of the flags FAN_MARK_MOUNT or FAN_MARK_FILESYSTEM can be used in conjunction with FAN_MARK_FLUSH. mask is ignored.

FAN_MARK_IGNORED_MASK

The events in mask shall be added to or removed from the ignore mask.

FAN_MARK_IGNORED_SURV_MODIFY

The ignore mask shall survive modify events.
If this flag is not set, the ignore mask is cleared when a modify event occurs for the ignored file or directory.

FAN_MARK_INODE

Mark the inode specified by pathname.
It is default way to mark.

FAN_MARK_MOUNT

Mark the mount point specified by pathname. If pathname is not itself a mount point, the mount point containing pathname will be marked.
All directories, subdirectories, and the contained files of the mount point will be monitored.
The events which require the fanotify_fd file descriptor to have been initialized with the flag FAN_REPORT_FID, such as FAN_CREATE, FAN_ATTRIB, FAN_MOVE, and FAN_DELETE_SELF, cannot be provided as a mask when flags contains FAN_MARK_MOUNT.
Attempting to do so will result in the error EINVAL being returned.

FAN_MARK_ONLYDIR

If the filesystem object to be marked is not a directory, the error ENOTDIR shall be raised.

FAN_MARK_REMOVE

The events in argument mask will be removed from the mark mask (or from the ignore mask). mask must be nonempty or the error EINVAL will occur.

FAN_MODIFY

Create an event when a file is modified (write).

FAN_MOVE

Create an event when a file was moved

FAN_MOVED_FROM

Create an event when a file was moved from X

FAN_MOVED_TO

Create an event when a file was moved to Y

FAN_MOVE_SELF

Create an event when self was moved

FAN_NOFD

Indicates a queue overflow.

FAN_NONBLOCK

Enable the nonblocking flag (O_NONBLOCK) for the file descriptor.

FAN_ONDIR

Create events for directories—for example, when opendir(3), readdir(3) (but see BUGS), and closedir(3) are called.
Without this flag, events are created only for files.
In the context of directory entry events, such as FAN_CREATE,FAN_DELETE, FAN_MOVED_FROM, and FAN_MOVED_TO, specifying the flag FAN_ONDIR is required in order to create events when subdirectory entries are modified (i.e., mkdir(2)/rmdir(2)).

FAN_OPEN

Create an event when a file or directory is opened.

FAN_OPEN_EXEC

Create an event when file was opened for exec

FAN_OPEN_EXEC_PERM

Create an event when a permission to open a file for exec is requested.
An fanotify file descriptor created with FAN_CLASS_PRE_CONTENT or FAN_CLASS_CONTENT is required.

FAN_OPEN_PERM

Create an event when a permission to open a file or directory is requested.
An fanotify file descriptor created with FAN_CLASS_PRE_CONTENT or FAN_CLASS_CONTENT is required.

FAN_Q_OVERFLOW

The event queue exceeded the limit of 16384 entries.

FAN_REPORT_DIR_FID

Flags to determine fanotify event format report unique directory id

FAN_REPORT_FID

Flags to determine fanotify event format report unique file id

FAN_REPORT_NAME

Flags to determine fanotify event format report events with name

FAN_REPORT_TID

Flags to determine fanotify event format event->pid is thread id

FAN_UNLIMITED_MARKS

Remove the limit of 8192 marks.
Use of this flag requires the CAP_SYS_ADMIN capability.

FAN_UNLIMITED_QUEUE

Remove the limit of 16384 events for the event queue.
Use of this flag requires the CAP_SYS_ADMIN capability.

Functions

close_fd

fanotify_init

Initializes a new fanotify group and returns a file descriptor for the event queue associated with the group.

fanotify_mark

Adds, removes, or modifies an fanotify mark on a filesystem object.

fanotify_read