File Integrity on Linux with fsnotify backend stops tracking files on delete.
Open
Auditbeat
Team:Security-Linux Platform
- Dominant language
- Go
- Stars
- 12.7k
- Forks
- 5k
- Avg merge
- 2d 15m
- Merged PRs (30d)
- 385
Description
For editors like vim, a temporary file is created until it's saved, at which point the temporary file is renamed over the top of the original file. This causes fsnotify to stop tracking the file. In fsnotify's defense, the files (inodes) are different, but it's not intuitive. And is definitely not expected for File Integrity
Contributor guide
Assessment
This issue has not been assessed yet.