Thanks All for ur reply...
From all these reading I have clear following things :
1: First question to get filename at the time of KAUTH_VNODE_ADD_FILE:
This is a place to do authorization about "Can I able to create a file in given directory?", but new file is not created yet so it is not possible to get newly created file name.
2: In second question I need to differentiate between open & read:
KAUTH_VNODE_READ_DATA is going to ask permission to read contents of file, so once we allow in case of open file, It is not going to ask again when we are going to read the file.
When I open any file (using terminal, programmatically, by finder etc.) I get different events like: (not only KAUTH_VNODE_READ_DATA)
- Programmatically using open call
KAUTH_VNODE_READ_DATA (open in read mode)
KAUTH_VNODE_WRITE_DATA (open in write mode)
- open in finder (using TextEditor)
Here I get many events like:
.
.
KAUTH_VNODE_WRITE_DATA | KAUTH_VNODE_ACCESS
KAUTH_VNODE_READ_DATA | KAUTH_VNODE_ACCESS
KAUTH_VNODE_EXECUTE_DATA | KAUTH_VNODE_ACCESS
KAUTH_VNODE_READ_DATA
.
.
- open in finder (using Dashcode)
Here I get events somewhat same as using TestEditor,
.
.
KAUTH_VNODE_WRITE_DATA | KAUTH_VNODE_ACCESS
KAUTH_VNODE_READ_DATA | KAUTH_VNODE_ACCESS
KAUTH_VNODE_EXECUTE_DATA | KAUTH_VNODE_ACCESS
.
.
following events are repeated when I open the file, trying to read, write or access in Dashcode, which is not in case of TextEditor, so the behavior is different.
How should I clear about file open events, so I can do particular activity when file is going to open. I have to also consider performance factor.
Thanks,
Sheetal.