Fire off a task when something is written under /etc/opensnitchd

[ashugg]

Question: is there some way to get opensnitch to either run a task, or touch a file like /tmp/.opensnitch_rules_updated, when it writes or deletes a rule in /etc/opensnitchd/rules?

I use etckeeper on my Ubuntu systems to keep /etc files under version control. When I remember, after allowing a new connection with the opensnitch gui, I run sudo etckeeper commit "Commit for opensnitchd rules" so that any files added, removed, or modified by opensnitch get wrapped up in a git commit. The problem is that sometimes I forget to do this, and maybe mess around with something else, so then my next sudo etckeeper commit includes opensnitch changes as well as whatever I was meaning to commit.

I can monitor /etc/opensnitchd/system-fw.json with systemd and run an etckeeper commit if that file is modified. However, I don't think systemd can watch a directory for files appearing, changing, or disappearing unless their names are known ahead of time.