aquasecurity / aquasecurity/tracee
File create high-level event
- Dominant language
- Go
- Stars
- 4.6k
- Forks
- 507
- Avg merge
- 2d 8h
- Merged PRs (30d)
- 9
Description
We need a high-level event for the creation of new files.
We need to think what is file creation before the implementation:
1. Inode creation, which is the unique representation of a file content.
2. The creation of a file (file struct?) which is an instance of a inode in the file system.
3. The association of an unoccupied path by a file (rename of a file is considered creation of a new file in this case).
Each has its pros and cons, as the content is according to the inode but the permissions and path is determined by the file. The path has its own importance, to track filesystem paths with the event.
This is an open discussion, you are welcome to add your opinions :)
Contributor guide
Assessment
This issue has not been assessed yet.