What process was responsible for the event designated inotify?

Question

I use pyinotifyto detect access, changes, etc. to files in this directory. Is there an easier way to find out which process is responsible for this - without patchinotify ?

Answer 1

No, you cannot, this information is not in the struct inotify_eventone sent by the kernel.

In fact, there is no guarantee that the responsible process is still running when you receive the event.

Answer 2

, Linux (pyinotify ), SELinux ( , ), ///etc.