Well ya, it's more useful in observability usecases than desktop ones. But recently I've been using for a consumer desktop usecase. I made a file watcher with it. I'm sure you're familiar with the woes of using inotify/fanotify.
eBPF vfs hooks based watchers are really nice.
[edit] details
- you setup a single `mount` - this is the only part that requires cap_sys_admin
- then you run a single daemon, this one only needs cap_bpf, and this runs once at startup and is its own self contained program
- this daemon writes events into a ringbuf referred to by a file in that bpf mount
- you then read that from your standard user program (this can be done by whichever application needs to consume the events)
the events are create, mkdir, delete. renames are automatically decomposed since we hook at the vfs layer. the hook itself is practically free to run and thus there is no question of a performance impact.
eBPF vfs hooks based watchers are really nice.
[edit] details
- you setup a single `mount` - this is the only part that requires cap_sys_admin - then you run a single daemon, this one only needs cap_bpf, and this runs once at startup and is its own self contained program - this daemon writes events into a ringbuf referred to by a file in that bpf mount - you then read that from your standard user program (this can be done by whichever application needs to consume the events)
the events are create, mkdir, delete. renames are automatically decomposed since we hook at the vfs layer. the hook itself is practically free to run and thus there is no question of a performance impact.