How does this work under the covers on Linux? Is it using eBPF, or is it simply an abstraction over inotify?
I'm particularly interested in something like this, but which will include information about what process made the change, and which user it was running as at the time.