Fanotify

Fanotify is a module of the Linux kernel , which allows the monitoring of access to files and folders ( English file access control ). Fanotify will u. a. used by the virus scanner ClamAV and the readahead implementation of systemd .

Fanotify was primarily designed to meet the needs of real-time virus scanners . It differs from Inotify in that it allows recursive monitoring of an entire file system and can also actively prevent access to a file. However, it is not intended as a replacement for Inotify as it cannot monitor renaming or deletion. It also requires root rights, whereas Inotify can be used by any user.

Web links

• Linux Programmer's Manual: Fanotify
• The fanotify API
• Borwinius knowledge base: Fanotify
• fanotify example userspace tools by Eric Paris

Individual evidence

1. ↑ fanotify: the fscking all notification system (LWN.net). Retrieved April 22, 2018 . 
2. ↑ Filesystem monitoring in the Linux kernel ( Memento from July 29, 2014 in the Internet Archive )