Re: [PATCH 1/1] Enable fanotify API by default.

[Greg KH <gregkh@linuxfoundation.org>]

On Sat, Jun 15, 2013 at 06:17:27PM +0200, xypron.glpk@gmx.de wrote:
> From: Heinrich Schuchardt <xypron.glpk@gmx.de>
> 
> The fanotify interface is the basis for on access malware detection
> in the Linux kernel. The development of a prior solution (DazukoFS)
> has been stopped therefore.
> 
> Both free (ClamAV) as well as commercial viurs scanners (Sophos
> Anti-Virus, AVG) using this interface exist.
> 
> Since kernel version 3.8.0 the implementationof the fanotify inter-
> face is errorfree enough to be used on a productive system.
> Personally I have been using it for virus scanning on multiple
> systems for several months without issues while a developing a
> wrapper around ClamAV, see
> https://github.com/xypron/skyldav
> 
> A large scale usage of the fanotify interface can only expected if
> the API is enabled by default.

We only set options to 'default Y' if they are needed in order to keep
your machine working properly.  Now that this option has been around for
a while, changing the default will not affect anyone's machines, as they
will not see that change.

Why not just work with the distros to enable fanotify, that's where you
need this enabled, not here.  Those are the majority of users, not
kernel developers who pick their own kernel configurations.

thanks,

greg k-h