#fanotify

Linux fanotify Permission Events: Building Access Mediation That Fails Safely

How fanotify groups mark filesystems, pause opens for an allow-or-deny response, expose queue overflow, and fail open when a policy daemon disappears.