Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #239135

Re: Watching a directory, was Re: how would you do this?

Show all headers | View raw

On Sat 21 Aug 2021 at 19:17:31 (+0530), didar wrote:
> On Thu, Aug 19, 2021 at 10:45:44PM -0500, David Wright wrote:
> > On Thu 19 Aug 2021 at 08:01:24 (-0400), songbird wrote:
> > > David Wright wrote:
> > > > On Wed 18 Aug 2021 at 20:55:12 (-0400), songbird wrote:
> > > >>   let's suppose you have a directory where there are
> > > >> various scripts, libraries, programs, data, etc.
> > > >> 
> > > >>   you want to know exactly which other scripts, libraries,
> > > >> etc. use them and to log each caller to know the name so
> > > >> it can be tracked down (location would be nice too, but 
> > > >> that could be found later if needed).
> > > >> 
> > > >>   i don't need to keep the information in a database as
> > > >> just having the log file will be enough.
> > > >> 
> > > >>   how would you do this?
> > > >> 
> > > >>   this isn't a homework assignment i'm just curious how
> > > >> easy or hard this would be to accomplish.
> > > >
> > > > Easy.
> > > >
> > > > $ inotifywait -m -e access --timefmt "%F %T" --format "%T %f" the-directory/
> > > >
> > > > To try it, just type in that line, using a sensible directory name.
> > > > (The package name to install first is inotify-tools.)
> > > >
> > > > Change the formats to taste. Pipe into a   while IFS=$'\n' read Filename ; do
> > > > loop if you want to do something with the output. See:
> > > >
> > > >   https://lists.debian.org/debian-user/2021/03/msg01494.html
> > > >
> > > > for a real script (waiting on close-writeable-file, rather than just
> > > > access) that I use a lot for stealing files from FireFox's cache
> > > > (~/.cache/mozilla/firefox/foo.bar.profile/cache2/entries/).
> > > 
> > >   thanks!  very interesting!  :)
> > > 
> > >   thank you to others who replied also.  :)
> > > 
> > >   i was wondering if there was a general tool available as on
> > > debian-devel they are talking about usr-merge and if there was a
> > > simple way to find out who's using /bin and such instead of 
> > > /usr/bin,
> > 
> > No, that's a different problem. My solution addresses a directory,
> > hence the change in Subject line. You'd have to dive deeper into
> > inotify and inotify_add_watch, to see whether you can specify the
> > inode of the /bin symlink separately from that for /usr/bin.
> > 
> > $ ls -Glidg /bin /usr/bin
> >     12 lrwxrwxrwx 1     7 Apr  3  2020 /bin -> usr/bin
> > 261634 drwxr-xr-x 2 69632 Aug 11 19:10 /usr/bin
> > $ 
> > 

To be more explicit, my understanding of symlinks is that they're
a property of the filesystem, and so are resolved in the kernel,
likely somewhere in fs/ext{2,4}. So nothing in userspace is likely
to be aware of whether a filename was referenced through a symlink.

> There is an "auditd" package - a Red Hat origin tool/subsystem. It's available
> on Bullseye, but, I have not tried it recently. It might be what you are looking
> for.

I would revise my "Easy", above, to Hard. You would have to write
rules to trigger logging just the right events in the kernel, and then
write a program to wade through the log, which will be pouring in from
all the processes triggering those events. Plus deal with the slowdown
from a heavy overhead if the rules aren't adequately focussed.

When the OP replied to my first post, I ran my one-liner on /bin,
and then tried running a few binaries by invoking them through /bin
and /usr/bin (which, of course, didn't reveal anything interesting).
However, I could only do this for ~50 seconds of each minute because
my crontab would spew a couple of screenfuls every time it triggered.

Let us know how it goes, should you attempt it.

Cheers,
David.

Back to linux.debian.user | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

how would you do this? songbird <songbird@anthive.com> - 2021-08-19 03:00 +0200
  Re: how would you do this? Cindy Sue Causey <butterflybytes@gmail.com> - 2021-08-19 03:30 +0200
    Re: how would you do this? songbird <songbird@anthive.com> - 2021-08-19 14:40 +0200
  Re: how would you do this? Roberto C. Sánchez <roberto@debian.org> - 2021-08-19 03:30 +0200
    Re: how would you do this? songbird <songbird@anthive.com> - 2021-08-19 14:40 +0200
  Re: how would you do this? Jeremy Ardley <jeremy@ardley.org> - 2021-08-19 03:40 +0200
    Re: how would you do this? songbird <songbird@anthive.com> - 2021-08-19 14:50 +0200
  Watching a directory, was Re: how would you do this? David Wright <deblis@lionunicorn.co.uk> - 2021-08-19 04:40 +0200
    Re: Watching a directory, was Re: how would you do this? songbird <songbird@anthive.com> - 2021-08-19 14:30 +0200
      Re: Watching a directory, was Re: how would you do this? David Wright <deblis@lionunicorn.co.uk> - 2021-08-20 05:50 +0200
        Re: Watching a directory, was Re: how would you do this? didar <nosferatu@purlo.in> - 2021-08-21 15:50 +0200
          Re: Watching a directory, was Re: how would you do this? David Wright <deblis@lionunicorn.co.uk> - 2021-08-22 06:40 +0200

csiph-web