fsmon: monitor filesystem on iOS / OS X / Android / FirefoxOS / Linux
fsmon
FileSystem Monitor utility that runs on Linux, Android, iOS, and OSX.
Backends
fsmon filesystem information is taken from different backends depending on the operating system and apis available.
This is the list of backends that can be listed with fsmon -L:
- inotify (linux / android)
- fanotify (linux > 2.6.36 / android with custom kernel)
- devfsev (osx /dev/fsevents – requires root)
- kqueue (xnu – requires root)
- kdebug (bsd?, xnu – requires root)
- fsevapi (osx filesystem monitor api)
Install
fsmon is a portable tool. It works on iOS, OSX, Linux, and Android (x86, arm, arm64, mips)
git clone https://github.com/nowsecure/fsmon.git
Linux
$ make
OSX + iOS fatbin
$ make
iOS
$ make ios
Android
$ make android NDK_ARCH=<ARCH> ANDROID_API=<API>
To get fsmon installed system-wide just type:
$ make install
Changing the installation path…
$ make install PREFIX=/usr DESTDIR=/
Use
The tool retrieves file system events from a specific directory and shows them in colorful format or in JSON.
It is possible to filter the events happening from a specific program name or process id (PID).
[pastacode lang=”markup” message=”” highlight=”” provider=”manual” manual=”Usage%3A%20.%2Ffsmon%20%5B-jc%5D%20%5B-a%20sec%5D%20%5B-b%20dir%5D%20%5B-B%20name%5D%20%5B-p%20pid%5D%20%5B-P%20proc%5D%20%5Bpath%5D%0A%20-a%20%5Bsec%5D%20%20stop%20monitoring%20after%20N%20seconds%20(alarm)%0A%20-b%20%5Bdir%5D%20%20backup%20files%20to%20DIR%20folder%20(EXPERIMENTAL)%0A%20-B%20%5Bname%5D%20specify%20an%20alternative%20backend%0A%20-c%20%20%20%20%20%20%20%20follow%20children%20of%20-p%20PID%0A%20-f%20%20%20%20%20%20%20%20show%20only%20filename%20(no%20path)%0A%20-h%20%20%20%20%20%20%20%20show%20this%20help%0A%20-j%20%20%20%20%20%20%20%20output%20in%20JSON%20format%0A%20-L%20%20%20%20%20%20%20%20list%20all%20filemonitor%20backends%0A%20-p%20%5Bpid%5D%20%20only%20show%20events%20from%20this%20pid%0A%20-P%20%5Bproc%5D%20events%20only%20from%20process%20name%0A%20-v%20%20%20%20%20%20%20%20show%20version%0A%20%5Bpath%5D%20%20%20%20only%20get%20events%20from%20this%20path”/]
Copyright (c) 2024 NowSecure, Inc
Source: https://github.com/nowsecure/
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
