# Re: fanotify as syscalls

- From: Jamie Lokier \<hidden\>
- Date: 2009-09-22 16:27:07 
- List: netdev
- Page: https://ratatoskr.run/netdev/2009/09/35408
- Thread: https://ratatoskr.run/linux-fsdevel/2009/09/35085/t.md

```text
Eric Paris wrote:
> That's not the fatal flaw.  The fatal flaw is that I am not going to
> write 90% of a rootkit and make it easy to use.

I hate to point out the obvious, but fanotify's ability to intercept
every file access and rewrite the file before the access proceeds is
also 90% of a rootkit...

But fortunately both fanotify and syscall rewriting require root in
the first place.

I think that makes the rootkit argument moot.  As long as fanotify
doesn't have a non-root flavour... which really would be handy for
rootkits :-)

> Easy != Good.

I agree.

-- Jamie
```