watching a file for ownership change

[Marco Molteni]

On Sun, 22 May 2005 04:05:50 +0100
Bruce M Simpson <bms at spc.org> wrote:

> On Sat, May 21, 2005 at 10:38:30PM -0400, Charles Sprickman wrote:
> > I'd like to find a way to watch one of the user's maildirsize files
> > that  seems to flip ownerships at least once a day and try to
> > determine what  process is changing the ownership.
> > How can I do that without dropping a bunch of daemons on a
> > production  machine into heavy-debug mode?  OS is 4.8 with all
> > current patches.
> 
> You could try watching kevent() on the file for EVFILT_VNODE with
> NOTE_ATTRIB. You'd need to write a small C program to do this.
> 
> Whilst this won't tell you who did what, it could give you
> sufficiently good timestamps from it happening to begin tracking the
> culprit down further, perhaps using lsof.

When I saw the first post I actually wrote the kevent program
you are sugesting as an exercise, then I realized that I couldn't
obtain the PID of the process that modified the file.

Would it be feasible/reasonable to add this feature to kqueue ?

marco