Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

File monitor: deliver only watched paths with es_invert_muting?

Abierto
  • ¿Algo no está bien?
#110 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
5/5
Tiempo estimado
Más de una semana
Aptitud para principiantes
35/100
Tipo de issue
Nueva funcionalidad
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
objective-c
Área
operating-systems, performance, security

Línea de trabajo

Start with FileMonitor.m:96 and Monitor.m:602-616, then inspect how the watched prefixes and file/process events are matched. Evaluate the proposed ES_MUTE_INVERSION_TYPE_TARGET_PATH behavior, including renames into watched directories and whether KERN_PROCARGS2 can replace exec/exit subscriptions. Done means the monitor avoids unnecessary events without creating a silent gap in watched-path coverage.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

On macOS 14+ the file monitor only alerts on a few prefixes (/Library/Extensions/, /System/Library/Extensions/, /private/var/at/tabs/), since launchd and login items moved to BTM events. But it still receives every create, write and rename on the machine, plus every exec and exit, and builds a File and Process object for each one before matching against the watch list (FileMonitor.m:96, Monitor.m:602-616).

On my machine (BlockBlock 2.5.2, macOS 15.7.3, M4 Max) the daemon averages about 21% of a core around the clock, and 0.3-0.8 of a core during builds and test runs. I measured roughly 2.4 µs per write and 130 µs per exec on a busy machine. Notarization and Block Scripts are off, so this is the file monitor.

Would you consider es_invert_muting(client, ES_MUTE_INVERSION_TYPE_TARGET_PATH) (macOS 13+) with the watched prefixes muted in, so the kernel only delivers events for paths BlockBlock can alert on? The exec/exit subscription seems to exist only to keep arguments for alert text, so reading the writer's arguments at alert time (KERN_PROCARGS2) could let that go too.

I understand there may be security reasons not to do this. A prefix list that drifts out of sync with the watch list would be a silent blind spot, and renames into a watched directory need care. If that's the reason it works this way, a note here would help others who hit the same cost (#35 looks related).

Lenguaje dominante
Objective-C
Estrellas
859
Forks
50
Sin PR fusionados en 30 d

Preparar el entorno

Este proyecto no incluye contenedor de desarrollo, Dockerfile ni guía de contribución, así que la configuración corre por tu cuenta: empieza por su README y consulta nuestra guía para la primera contribución para los pasos generales.

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de objective-see/BlockBlock

Todos los issues de objective-see/BlockBlock

Issues similares

Más issues de Objective-C

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.