File monitor: deliver only watched paths with es_invert_muting?
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 35/100
- Issue type
- Feature
- Clarity
- Mostly clear
- Activity status
- Active
- Tech stack
- objective-c
- Domain
- operating-systems, performance, security
Research direction
Start with FileMonitor.m:96 and Monitor.m:602-616, then inspect how the watched prefixes and file/process events are matched. Evaluate the proposed ES_MUTE_INVERSION_TYPE_TARGET_PATH behavior, including renames into watched directories and whether KERN_PROCARGS2 can replace exec/exit subscriptions. Done means the monitor avoids unnecessary events without creating a silent gap in watched-path coverage.
Written by the indexing model from the issue text.
Description
On macOS 14+ the file monitor only alerts on a few prefixes (/Library/Extensions/, /System/Library/Extensions/, /private/var/at/tabs/), since launchd and login items moved to BTM events. But it still receives every create, write and rename on the machine, plus every exec and exit, and builds a File and Process object for each one before matching against the watch list (FileMonitor.m:96, Monitor.m:602-616).
On my machine (BlockBlock 2.5.2, macOS 15.7.3, M4 Max) the daemon averages about 21% of a core around the clock, and 0.3-0.8 of a core during builds and test runs. I measured roughly 2.4 µs per write and 130 µs per exec on a busy machine. Notarization and Block Scripts are off, so this is the file monitor.
Would you consider es_invert_muting(client, ES_MUTE_INVERSION_TYPE_TARGET_PATH) (macOS 13+) with the watched prefixes muted in, so the kernel only delivers events for paths BlockBlock can alert on? The exec/exit subscription seems to exist only to keep arguments for alert text, so reading the writer's arguments at alert time (KERN_PROCARGS2) could let that go too.
I understand there may be security reasons not to do this. A prefix list that drifts out of sync with the watch list would be a silent blind spot, and renames into a watched directory need care. If that's the reason it works this way, a note here would help others who hit the same cost (#35 looks related).
- Dominant language
- Objective-C
- Stars
- 859
- Forks
- 50
- PR merge metrics
- No merged PRs in 30d
Getting set up
This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from objective-see/BlockBlock
-
Typo in installer: “addition protections” → “additional protections”Possibly taken @Jah-yee claimed this 5 days ago. Open
Difficulty 1/5 Under an hour Newbie friendliness 94/100
objective-see/BlockBlock#111 ·
-
Difficulty 3/5 1-2 days Newbie friendliness 42/100
objective-see/BlockBlock#109 ·
-
Difficulty 4/5 3-5 days Newbie friendliness 64/100
objective-see/BlockBlock#108 ·
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
objective-see/BlockBlock#107 ·
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
objective-see/BlockBlock#104 ·
All issues in objective-see/BlockBlock
Similar issues
-
Missing info Missing repro Platform: iOS
Difficulty 2/5 1-3 hours Newbie friendliness 64/100
software-mansion/react-native-reanimated#10908 · 2 comments ·
Maintainers usually reply within 1 day
-
Missing repro
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
software-mansion/react-native-svg#3082 · 1 comment ·
Maintainers usually reply within 1 day
-
bug-pending-triage
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
NativeScript/NativeScript#11525 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
holepunchto/bare-bluetooth-apple#84 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
AvaloniaUI/Avalonia#22461 ·
Maintainers usually reply within 2 days