fanotify_init(2) System Calls Manual fanotify_init(2) fanotify_init - fanotify (libc -lc) #include /* O_* */ #include int fanotify_init(unsigned int flags, unsigned int event_f_flags); fanotify fanotify(7). fanotify_init() fanotify . fanotify_mark(2) fanotify. . . . . fanotify . fanotify . fanotify(7) . flags . . flags: FAN_CLASS_PRE_CONTENT . . . CAP_SYS_ADMIN. FAN_CLASS_CONTENT . . . CAP_SYS_ADMIN. FAN_CLASS_NOTIF . . . . FAN_CLASS_PRE_CONTENT FAN_CLASS_CONTENT FAN_CLASS_NOTIF. . flags: FAN_CLOEXEC (FD_CLOEXEC) . O_CLOEXEC open(2). FAN_NONBLOCK (O_NONBLOCK) . . read(2) EAGAIN. FAN_UNLIMITED_QUEUE . fanotify(7) . CAP_SYS_ADMIN. FAN_UNLIMITED_MARKS fanotify . fanotify(7) . CAP_SYS_ADMIN. FAN_REPORT_TID ( 4.20) (TID) (PID) pid struct fanotify_event_metadata read(2) ( fanotify(7)). CAP_SYS_ADMIN. FAN_ENABLE_AUDIT ( 4.15) . FAN_AUDIT . CAP_AUDIT_WRITE. FAN_REPORT_FID ( 5.1) . FAN_EVENT_INFO_TYPE_FID . . . FAN_CREATE FAN_DELETE FAN_MOVE FAN_RENAME FAN_ATTRIB FAN_DELETE_SELF FAN_MOVE_SELF. fanotify . FAN_REPORT_TARGET_FID //. FAN_CLASS_CONTENT FAN_CLASS_PRE_CONTENT EINVAL. fanotify(7) . FAN_REPORT_DIR_FID ( 5.9) fanotify ( ) . FAN_EVENT_INFO_TYPE_DFID . . . FAN_REPORT_FID . . FAN_REPORT_FID . FAN_REPORT_FID . fanotify(7) . FAN_REPORT_NAME ( 5.9) fanotify . FAN_REPORT_DIR_FID. FAN_REPORT_DIR_FID EINVAL. FAN_REPORT_FID. FAN_EVENT_INFO_TYPE_DFID_NAME FAN_EVENT_INFO_TYPE_DFID. . FAN_CREATE FAN_DELETE FAN_MOVE //. FAN_RENAME FAN_EVENT_INFO_TYPE_OLD_DFID_NAME FAN_EVENT_INFO_TYPE_NEW_DFID_NAME . '.'. . open_by_handle_at(2) fstatat(2). FAN_EVENT_INFO_TYPE_DFID FAN_EVENT_INFO_TYPE_DFID_NAME: . . fanotify(7) . FAN_REPORT_DFID_NAME (FAN_REPORT_DIR_FID|FAN_REPORT_NAME). FAN_REPORT_TARGET_FID ( 5.17 5.15.154 5.10.220) fanotify . FAN_REPORT_FID FAN_REPORT_DIR_FID FAN_REPORT_NAME EINVAL. FAN_CREATE FAN_DELETE FAN_MOVE FAN_RENAME FAN_EVENT_INFO_TYPE_FID FAN_EVENT_INFO_TYPE_DFID FAN_EVENT_INFO_TYPE_DFID_NAME FAN_EVENT_INFO_TYPE_OLD_DFID_NAME FAN_EVENT_INFO_TYPE_NEW_DFID_NAME. . FAN_REPORT_DFID_NAME_TARGET (FAN_REPORT_DFID_NAME|FAN_REPORT_FID|FAN_REPORT_TARGET_FID). FAN_REPORT_MNT ( 6.14) . FAN_EVENT_INFO_TYPE_MNT . FAN_CLASS_CONTENT FAN_CLASS_PRE_CONTENT FAN_REPORT_DFID_NAME_TARGET EINVAL. fanotify(7) . FAN_REPORT_PIDFD ( 5.15 5.10.220) fanotify fanotify_event_metadata . FAN_EVENT_INFO_TYPE_PIDFD pidfd . pidfd pidfd pidfd_open(2). . FAN_REPORT_TID FAN_REPORT_PIDFD EINVAL. pidfd API pidfds . pidfds . fanotify(7). FAN_REPORT_FD_ERROR ( 6.13 6.12.4 6.6.66) fanotify . .fd fanotify_event_metadata FAN_NOFD . FAN_NOFD .fd fanotify_event_metadata . FAN_REPORT_PIDFD .pidfd fanotify_event_info_pidfd . fanotify(7). event_f_flags fanotify. flags open(2). event_f_flags : O_RDONLY . O_WRONLY . O_RDWR . event_f_flags : O_LARGEFILE 2 . EOVERFLOW fanotify 32 . O_CLOEXEC ( 3.18) . O_CLOEXEC open(2) . : O_APPEND O_DSYNC O_NOATIME O_NONBLOCK O_SYNC. event_f_flags EINVAL ( ). fanotify_init() . -1 errno . EINVAL flags event_f_flags. FAN_ALL_INIT_FLAGS ( 4.20) flags. EMFILE fanotify . fanotify(7) . EMFILE . ENOMEM . ENOSYS fanotify_init(). fanotify CONFIG_FANOTIFY. EPERM . 5.13 ( 5.10.220) fanotify_init() CAP_SYS_ADMIN. 5.13 ( 5.10.220) fanotify_init() CAP_SYS_ADMIN fanotify . CAP_SYS_ADMIN : o FAN_UNLIMITED_QUEUE. o FAN_UNLIMITED_MARKS. o FAN_CLASS_CONTENT FAN_CLASS_PRE_CONTENT. . o FAN_REPORT_FID. o inodes . fanotify_mark() FAN_MARK_MOUNT FAN_MARK_FILESYSTEM . o . pid . . 2.6.37. 3.18: o O_CLOEXEC event_f_flags. 3.14: o event_f_flags . FMODE_EXEC fanotify. fanotify_mark(2), fanotify(7) 3 . . : . 6.18 17 2025 fanotify_init(2)