[suggestion] Watch fs with inotifywatch

[yurivict]

Currently poudriere uses mtree before and after to detect fs violations.

A better approach is to use inotifywatch from sysutils/inotify-tools. For example:

$ inotifywatch /var/db /var/cache /usr/bin /usr/share
Establishing watches...
Finished establishing watches, now collecting statistics.
# ... some process creates some files in these directories and deletes them
^Ctotal  access  attrib  close_nowrite  open  create  delete  filename
529    249     1       143            134   1       1       /usr/share/
7      0       1       2              2     1       1       /usr/bin/
3      0       1       0              0     1       1       /var/db/
3      0       1       0              0     1       1       /var/cache/

Poudriere can watch all existing directories outside the ones allowed to be modified. inotifywatch can easily be made to be a self-contained executable.

[michael-o]

Wouldn't kqueue suffice?

[bdrewery]

inotifywatch does use kqueue, it just provides a simpler API for a shell to watch paths rather than C.

[michael-o]

The name is confusing because inotify is a Linux thing.

[bdrewery]

Yup, from what I remember inotifywatch uses libinotify which we've implemented with kqueue on FreeBSD.

[grahamperrin]

Does eventfd offer any potential future benefit? https://reviews.freebsd.org/D26668#711156