Hacker News Reader

Comment by spenczar5 | Hacker News Reader

This seems a little roundabout. Why is this preferable over using `inotify(7)`? That's an existing system which can notify your userspace driver program about any time `setxattr(2)` is called.

I get that it's fun to experiment with BPF, but it's also useful to see how many tools already exist. BPF is powerful, yes - maybe too powerful, and it's often not the best tool for the job.

View on HN

Here you probably want fanotify, not inotify. The later would require setting up a lot of inotify entries, recursing through the filesystem.

https://man7.org/linux/man-pages/man7/fanotify.7.html

I think fanotify does xattrs, but I haven't tested.

Exactly this. I should have mentioned it in the post. Might amend it.

Would be interesting to compare the chances of race conditions with inotify vs BPF for this contrived use-case.

Just curious why you wouldn’t amend it?

Doesn’t take away from the original point that bpf is cool.

Because it's from 2020/21, not even like it's a factual error, and OP may not have the interest to revisit it?

I would still think that eBPF is a better suited approach. With fanotify, you would need to manage the mount points for which notifications need to be received. This works semi-OK for a static use case, but not for dynamically-created mounts and, worse, mount namespaces. In other words, fanotify is not suitable at all, without a lot of glue, for monitoring events happening in containers. And, for example, clamonacc (on-access file checking for ClamAV) does not work with removable storage, temporary network mounts, and containers for this very reason.

Reply on news.ycombinator.com