fanotify is intended to provide an interface for on access file scanning and permissions gating based on the results of those scans. fanotify does not prevent, nor does it attempt to prevent, malicious code running on the Linux machine.
fanotify provides two things:
A new notification system, similar to inotify, only instead of an arbitrary 'watch descriptor' which userspace has to know how to map back to an object on the filesystem, fanotify provides an open read-only fd back to the original object. It should be noted that the set of fanotify events is much smaller than the set of inotify events.
An access system in which processes may be blocked until the fanotify userspace listener has decided if the operation should be allowed.
