Skip to content

inotify_add_watch

Intro

inotify_add_watch - add watch for an open inotify instance

Description

inotify_add_watch is a system call used to watch a given file or directory for certain events. It will return a watch descriptor that identifies the watch instance. This descriptor is used as an argument for other functions that manipulate the watch instance. Events such as changes in access time, modification time, deletion and close- write operations will trigger notifications. With this system call, the user can specify different types of events that should be monitored.

Arguments

  • fd:int[K] - the file descriptor associated with an open inotify instance
  • pathname:const char*[U] - the path to the file or directory to watch
  • mask:u32[K] - a bit mask of events to watch for

Available Tags

  • K - Originated from kernel-space.
  • U - Originated from user space (for example, pointer to user space memory used to get it)
  • TOCTOU - Vulnerable to TOCTOU (time of check, time of use)
  • OPT - Optional argument - might not always be available (passed with null value)

Hooks

do_inotify_add_watch

Type

Kprobe

Purpose

This function is used to hook inotify_add_watch in order to obtain notifications when a new watch is registered.

Example Use Case

inotify_add_watch could be used to detect access attempts to certain sensitive files on a system. Whenever the file is accessed, a notification will be sent to the user, allowing them to take appropriate action.

Issues

Due to the asynchronous nature of inotify_add_watch, there is potential for a race condition when multiple watches are registered on the same file concurrently. Care must be taken to ensure that concurrent update operations don't make use of inconsistent data.

  • inotify_rm_watch - remove watch associated with a given inotify instance associated with given file descriptor
  • inotify_get_events - read the pending events on an inotify file descriptor

This document was automatically generated by OpenAI and needs review. It might not be accurate and might contain errors. The authors of Tracee recommend that the user reads the "events.go" source file to understand the events and their arguments better.