Get UID/Username of a deleted file or folder entry

[manikandan-kandasamy]

Hi,

I would like to fetch the user id (UID) or username of who has deleted a file or folder entry from inotifier.

As the file is not present (after deletion), we can't get it from the stat.

Does rb-inotify already supports it? If not how it can be addressed? Any workarounds?

Your early reply will be highly appreciated.

• Event:

  {
  "event": "delete",
  "name": "New folder",
  "path": "/programs/New folder",
  "type": "folder"
  }

  Environment details:

• OS:

  
  CentOS Linux release 7.3.1611 (Core) 
  NAME="CentOS Linux"
  VERSION="7 (Core)"
  ID="centos"
  ID_LIKE="rhel fedora"
  VERSION_ID="7"
  PRETTY_NAME="CentOS Linux 7 (Core)"
  ANSI_COLOR="0;31"
  CPE_NAME="cpe:/o:centos:centos:7"
  HOME_URL="https://www.centos.org/"
  BUG_REPORT_URL="https://bugs.centos.org/"

CENTOS_MANTISBT_PROJECT="CentOS-7" CENTOS_MANTISBT_PROJECT_VERSION="7" REDHAT_SUPPORT_PRODUCT="centos" REDHAT_SUPPORT_PRODUCT_VERSION="7"

CentOS Linux release 7.3.1611 (Core) CentOS Linux release 7.3.1611 (Core)

- **Ruby and gem version:**
   - ruby-2.4.4 [ x86_64 ]
   - rb-inotify (0.9.10)

Thank you!

[ioquatix]

Is it possible using native C methods?

[manikandan-kandasamy]

Is it possible using native C methods?

@ioquatix Thanks for your reply. Is it a question or a probable solution you are proposing.

If it's a probable solution then yes, if we can consume those native C methods from Ruby.

Thank you!

[ioquatix]

No, it’s just that I don’t know if any information like that is present, so I’m wondering if there is C API which provides what you want.

Otherwise what about caching the information you want?

[manikandan-kandasamy]

@ioquatix Thank you very much for your reply.

Ok, I don't have much idea about caching in this regard. What sort of information we need to cache? The filesystem snapshot (list of files and its metadata)? Can you please provide more intel on that.

Requirement/Use case: When a user deletes a file, we want to know the UID and username of the user along with the deleted file path.

Even though if we cache the filesystem snapshot (list of files and its metadata ) which will have who can access/delete that file, but it won't provide us which user has actually deleted that file.

Is it possible to get it from audit records in linux or canrb-inotify gem makes use of audit internally to fetch UID and username of the user?

Thanks again!

[ioquatix]

This is definitely outside the scope of rb-inotify. But it makes sense and it's not a stupid idea.

You'd probably need to join the dots together. If this is a commercial project, I'd be happy to work on this for you as a paid consultant.