Support getting notified about read access.
Maybe with direct inotify's IN_ACCESS et al. E.g. à la https://github.com/mojadita/INotify; but today probably better with JNA (like here) instead JNI.
But test with non-Java, first try inotifywait.
Alternative, possibly better: systrace -e trace=file, better? Using, or emulating, structured output. (It's OK if it doesn't work for JVM itself, but only launched processes; this could be integrated with ch.vorburger.exec.)
It can even inject fault errors, so effectively "sandbox", like a container with a r.o. FS!
strace has some performance overhead (but --seccomp-bpf helps, a lot?); SystemTap may be more efficient.
Support getting notified about read access.
Maybe with directinotify'sIN_ACCESSet al. E.g. à la https://github.com/mojadita/INotify; but today probably better with JNA (like here) instead JNI.But test with non-Java, first try inotifywait.
Alternative, possibly better:
systrace -e trace=file, better? Using, or emulating, structured output. (It's OK if it doesn't work for JVM itself, but only launched processes; this could be integrated with ch.vorburger.exec.)It can even inject fault errors, so effectively "sandbox", like a container with a r.o. FS!
strace has some performance overhead (but --seccomp-bpf helps, a lot?); SystemTap may be more efficient.