How to find out the type of a file system object when handling ES_EVENT_TYPE_AUTH_CREATE?

Privacy & Security General
ilowry OP
Created
Replies 1
Boosts 0
Views 1k
Participants 2

The ES_EVENT_TYPE_AUTH_CREATE event can be fired either for a regular file or for a directory. Currently there is no such kind of information in the event structure. Is there any way to find out what exactly the kind of the object is being created right in the ES_EVENT_TYPE_AUTH_CREATE handler?

Thanks in advance, Aleksandr Skobelev

Answered by DTS Engineer in 697300022

There’s two cases here:

  • If destination_type is ES_DESTINATION_TYPE_EXISTING_FILE, you get the full struct stat information in destination.existing_file.stat. That includes the st_mode field.

  • If destination_type is ES_DESTINATION_TYPE_NEW_PATH, you get the mode in destination.new_path.mode.

Either way, you should be able to extract the type of file system object from the mode using S_ISDIR, S_ISREG, and so on. Is that not working in the new path case?

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Replies  1
Boosts 0
Views  1k
Participants  2
DTS Engineer OP
Apple
Accepted Answer

There’s two cases here:

  • If destination_type is ES_DESTINATION_TYPE_EXISTING_FILE, you get the full struct stat information in destination.existing_file.stat. That includes the st_mode field.

  • If destination_type is ES_DESTINATION_TYPE_NEW_PATH, you get the mode in destination.new_path.mode.

Either way, you should be able to extract the type of file system object from the mode using S_ISDIR, S_ISREG, and so on. Is that not working in the new path case?

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"