search

linux-application-whitelisting / fapolicyd

File Access Policy Daemon
GNU General Public License v3.0
192 stars 55 forks source link

Indicate when polling has started #228

Closed jw3 closed 1 year ago

jw3 commented 1 year ago

There is a space between when the daemon is "up" and when it starts polling. The duration of this space is determined by the size of the trust database.

Would it be possible to write a flag file to disk, right before the polling starts, to indicate that polling has begun.

This would likely be written where the log message "Starting to listen for events" is output.

If I missed this functionality already please point me in the right direction.

radosroka commented 1 year ago

There is no dedicated way how to be notified about that... Right now we are relying on the message to appear in testing.

stevegrubb commented 1 year ago

It is written to syslog as LOG_INFO priority.

jw3 commented 1 year ago

Parsing the log output does work, though watching for a .pid like file on disk would be cleaner (for me :wink: )

I should have titled this issue "Write a file to indicate polling has started"

The use case here is to signal when it is time for an application to be started to ensure fapolicyd will observe all events it generates.

jw3 commented 1 year ago

The log parsing works fine, nothing further needed