How to find out the type of a file system object when handling ES_EVENT_TYPE_AUTH_CREATE?

The ES_EVENT_TYPE_AUTH_CREATE event can be fired either for a regular file or for a directory. Currently there is no such kind of information in the event structure. Is there any way to find out what exactly the kind of the object is being created right in the ES_EVENT_TYPE_AUTH_CREATE handler?

Thanks in advance, Aleksandr Skobelev

Accepted Reply

There’s two cases here:

  • If destination_type is ES_DESTINATION_TYPE_EXISTING_FILE, you get the full struct stat information in destination.existing_file.stat. That includes the st_mode field.

  • If destination_type is ES_DESTINATION_TYPE_NEW_PATH, you get the mode in destination.new_path.mode.

Either way, you should be able to extract the type of file system object from the mode using S_ISDIR, S_ISREG, and so on. Is that not working in the new path case?

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

  • Where were my eyes?! You are absolutely right! Oh my God, I'm still impenetrably stupid! Thank you very much!

Add a Comment

Replies

There’s two cases here:

  • If destination_type is ES_DESTINATION_TYPE_EXISTING_FILE, you get the full struct stat information in destination.existing_file.stat. That includes the st_mode field.

  • If destination_type is ES_DESTINATION_TYPE_NEW_PATH, you get the mode in destination.new_path.mode.

Either way, you should be able to extract the type of file system object from the mode using S_ISDIR, S_ISREG, and so on. Is that not working in the new path case?

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

  • Where were my eyes?! You are absolutely right! Oh my God, I'm still impenetrably stupid! Thank you very much!

Add a Comment