Skip to content

Conversation

@xlejo
Copy link

@xlejo xlejo commented Dec 6, 2025

This changes the behavior of OnAccessMountPath with OnAccessPrevention.

  • If prevention is enabled, all paths in OnAccessMountPath will be enabled excluding the root directory and non-mountpoints!

Config and behavior example:

OnAccessExcludeRootUID yes
OnAccessExcludeUname clamav
OnAccessPrevention yes
OnAccessMountPath /media/user/drive        # prevention is enabled
OnAccessMountPath /                        # prevention is disabled for root directory
OnAccessMountPath /media/user2/other-drive # prevention is enabled
OnAccessMountPath /media                   # prevention is disabled for non-mountpoints

This would be very useful for real-time analysis (and prevention) of media drives.

@xlejo xlejo force-pushed the fanotify-blocking-onaccessmountpath branch from 54a8070 to c82a57f Compare December 6, 2025 05:31
@xlejo xlejo force-pushed the fanotify-blocking-onaccessmountpath branch from c82a57f to 8edd1e6 Compare December 6, 2025 05:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant