Inotifywait Shenanigans

Inotifywait

Description

From the man page.

NAME
       inotifywait, fsnotifywait - wait for changes to files using inotify or fanotify

DESCRIPTION
       inotifywait  efficiently waits for changes to files using Linux's inotify(7) interface.  It is
       suitable for waiting for changes to files from shell scripts.  It  can  either  exit  once  an
       event occurs, or continually execute and output events as they occur.

Examples

Cat on Write

• Term 1: inotifywait listener

» notifywait -qqe close_write fart.txt && cat fart.txt

Args are:

       -e <event>, --event <event>
              Listen  for specific event(s) only.  The events which can be listened for are listed in
              the EVENTS section.  This option can be specified more  than  once.   If  omitted,  all
              events are listened for.

        -q, --quiet
              If specified once, the program will be less verbose.  Specifically, it will  not  state
              when it has completed establishing all inotify watches.

              If specified twice, the program will output nothing at all, except in the case of fatal
              errors.

Man inotifywait

• Term 2: Write to fart.txt

» echo fart fart fart > fart.txt

• Term 1: fart.txt catt'ed

» notifywait -qqe close_write fart.txt && cat fart.txt
fart fart fart

Well now you might say "interesting but what good is that?" Well with a slight modification we can set a bit of a trap.

Exec on Cat 👨‍💼/🐱

• Term 1: Set Tripwire

» inotifywait -qqe open fart.txt && ./run_hax.sh

• Term 2: Harmlessly Cat a File

» cat fart.txt

• Term 1: Hax Triggered!

» inotifywait -qqe open fart.txt && ./run_hax.sh
Running Hax...

Sources

https://superuser.com/questions/181517/how-to-execute-a-command-whenever-a-file-changes

https://linux.die.net/man/1/inotifywait