inotify在Ubuntu中的权限设置

Inotify in Ubuntu: Key Permission Settings and Configurations

Inotify is a Linux kernel subsystem that monitors file system events (e.g., creation, deletion, modification). On Ubuntu, proper permission settings are critical to ensure inotify works as intended—whether for monitoring user files, system directories, or triggering automated actions. Below are the essential permission configurations and system limits to manage:

1. System Limits for Inotify (Adjusting Resource Boundaries)

Inotify relies on three key system parameters to control resource usage. If these limits are too low, you may encounter errors like “Too many open files” or “INotify instance limit reached.”

Parameters Explained

• max_user_instances: Maximum number of inotify instances a single user can create (default: 128).
• max_user_watches: Maximum number of files/directories a user can monitor simultaneously (default: 8,192).
• max_queued_events: Maximum number of events queued per inotify instance (default: 16,384).

Temporary Adjustment (Until Reboot)

Use sysctl to modify limits dynamically. For example, to increase max_user_watches to 524,288 (common for large-scale monitoring):

sudo sysctl fs.inotify.max_user_watches=524288

Verify the change:

cat /proc/sys/fs/inotify/max_user_watches

Permanent Adjustment (Survives Reboot)

Edit /etc/sysctl.conf to make changes persistent. Add these lines (customize values as needed):

fs.inotify.max_user_instances=1024
fs.inotify.max_user_watches=524288
fs.inotify.max_queued_events=32768

Apply changes immediately:

sudo sysctl -p

2. File/Directory Permissions for Monitoring

To monitor a directory or file with inotifywait (from inotify-tools), the user must have read permissions on the target and execute permissions on its parent directory (to traverse the path).

Example: Monitoring /var/www/html

• Grant read access to the target directory:

  sudo chmod +r /var/www/html
  

• Ensure execute access on parent directories (e.g., /, /var, /var/www):

  sudo chmod +x / /var /var/www
  

• Verify permissions:

  ls -ld / /var /var/www /var/www/html
  

  Output should show dr-xr-xr-x (execute) for parent directories and dr--r--r-- (read) for the target.

3. User/Group Ownership for Secure Monitoring

Restrict access to monitored paths to specific users/groups to prevent unauthorized modifications or snooping.

Change Ownership

Assign the target directory to a dedicated user/group (e.g., webadmin):

sudo chown -R webadmin:webadmin /var/www/html

Add Users to the Group

Allow other users to monitor the directory by adding them to the group:

sudo usermod -aG webadmin your_username

Log out and back in for group changes to take effect.

4. Log File Permissions (For Audit Trails)

If using scripts to log inotify events (e.g., monitor_permissions.sh), ensure the log file is secure and only accessible to authorized users.

Example Script (monitor_permissions.sh)

#!/bin/bash
MONITOR_DIR="/etc/sudoers.d"
LOG_FILE="/var/log/permissions_monitor.log"
inotifywait -m -r -e modify,attrib,close_write,move,create,delete --format '%w%f' "$MONITOR_DIR" | while read FILE; do
  echo "$(date): File $FILE was modified" >> "$LOG_FILE"
done

Set Permissions

• Change ownership of the log file to the user running the script (e.g., root):

  sudo chown root:root /var/log/permissions_monitor.log
  

• Restrict access to the log file (read/write for owner only):

  sudo chmod 600 /var/log/permissions_monitor.log
  

5. SELinux/AppArmor (Optional: Mandatory Access Control)

For enhanced security, use SELinux (Ubuntu doesn’t enable it by default) or AppArmor to restrict inotify access. AppArmor profiles can limit which processes can use inotify and what paths they can monitor.

Check AppArmor Status

sudo aa-status

Edit an AppArmor Profile

For example, to restrict inotifywait to /var/www/html only, edit the profile (e.g., /etc/apparmor.d/usr.bin.inotifywait):

/dev/null r,
/proc/*/fd r,
/var/www/html/** rw,

Reload the profile:

sudo systemctl reload apparmor

Key Notes

• Avoid Overly Permissive Settings: Granting +rwx on system directories (e.g., /) can expose sensitive files to monitoring.
• Test Changes: After adjusting permissions, verify inotify works as expected (e.g., inotifywait -m /path/to/test).
• Logs Rotation: Regularly rotate log files (e.g., using logrotate) to prevent disk space exhaustion.

By following these steps, you can configure inotify permissions on Ubuntu to balance functionality and security for your monitoring needs.