Filtering fanotify events with BPF

Linux systems can have large filesystems; trying to keep up with the stream of fanotify filesystem-monitoring notifications for them can be a struggle. Fanotify is one of a few ways to monitor accesses to filesystems provided by the kernel. Song Liu led a discussion on how to improve in-kernel filtering of fanotify events to a joint session of the filesystem and BPF tracks at the 2025 Linux Storage, Filesystem, Memory-Management, and BPF Summit. He wants to combine the best parts of a few different approaches to efficiently filter filesystem events.

Linux 系统可能拥有庞大的文件系统；而试图跟上 fanotify 提供的文件系统监控通知流是一个挑战。fanotify 是内核提供的几种文件访问监控机制之一。在 2025 年的 Linux 存储、文件系统、内存管理与 BPF 峰会（LSFMM+BPF）上，Song Liu 主持了一场关于改进内核中 fanotify 事件过滤的联合讨论会，参与者来自文件系统和 BPF 两个子议题。他希望结合几种方法的优点，高效地过滤文件系统事件。

There are two ways to monitor and restrict filesystem actions on Linux, Liu said: fanotify and Linux security modules (LSMs). They both have benefits and drawbacks. The main problem with using LSM hooks to respond to filesystem events is that LSM hooks are global — the LSM must respond to accesses for all files, even if it's only interested in a subset of files. The main problem with fanotify is that notifications are handled in user space, incurring a lot of context switches. The best of both worlds would be to have efficient mask-based filtering for relevant files (like fanotify) and fast in-kernel handling for the more complicated cases (like LSMs).

Liu 表示，在 Linux 中监控和限制文件系统行为的方式有两种：fanotify 和 Linux 安全模块（LSM）。它们各有利弊。LSM 的主要问题是 hook 是全局的——即使只关心一部分文件，LSM 仍然必须响应所有文件的访问。而 fanotify 的问题则在于通知处理在用户空间进行，导致频繁的上下文切换。理想的方案应当是结合两者优势：使用类似 fanotify 的高效掩码机制来筛选感兴趣的文件，同时对更复杂的场景采用 LSM 提供的内核态快速处理能力。

One member of the audience pointed out that LSM hooks are invoked for all filesystem operations, but fanotify can only block calls to open() and read(), so they're not really comparable. Liu agreed, but said that was a separate topic.

一位与会者指出，LSM hook 会在所有文件系统操作中触发，而 fanotify 只能拦截 open() 和 read() 调用，因此两者其实并不具备可比性。Liu 表示认同，但认为这是另一个话题。

Liu then went into a little more detail about how BPF-LSM hooks work. Multiple BPF programs can att