fanotifyinit

Fanotify_init is a Linux kernel system call that creates a new fanotify instance and returns a file descriptor used by user space to receive file system events. The interface is part of the fanotify family, which enables real-time notifications about file and directory activities for security, monitoring, and access control purposes. Applications such as antivirus engines, data loss prevention tools, and integrity monitors commonly use fanotify to observe and potentially intervene in file operations.

The function takes two arguments: flags and event_f_flags. The flags select the notification class and behavior, most notably FAN_CLASS_NOTIF, which provides asynchronous event notifications that the user space must read and respond to, and FAN_CLASS_CONTENT, which allows the kernel to provide access to or inspect file content in certain operations. Additional flags such as FAN_NONBLOCK and FAN_CLOEXEC control nonblocking I/O and close-on-exec behavior, respectively. The second argument, event_f_flags, specifies the behavior of the event file descriptor itself, such as whether it is opened for reading and whether nonblocking I/O is used.

After initializing a fanotify instance, an application uses fanotify_mark to register specific files or mount points to monitor, along with a mask that defines which events to report (for example, open, access, attribute changes). Events are delivered by reading from the fanotify file descriptor. In the FAN_CLASS_NOTIF mode, the application must respond to each event by issuing a verdict (authorize or deny) back to the kernel, typically via a fanotify_response structure. In FAN_CLASS_CONTENT mode, some workflows can include direct inspection of file content or behavior before making a decision.

Fanotify is used for real-time security monitoring and enforcement, but its complexity and the need for careful handling of verdicts limit its use to capable software. It is often contrasted with inotify, offering broader and more granular control at the cost of greater complexity.