Messages in this thread | | | Subject | Re: Syscall table AKA hijacking syscalls | From | Arjan van de Ven <> | Date | Fri, 02 Jan 2004 20:15:45 +0100 |
| |
On Fri, 2004-01-02 at 19:58, Libor Vanek wrote: > On Fri, Jan 02, 2004 at 07:04:31PM +0100, Jörn Engel wrote: > > On Fri, 2 January 2004 17:59:22 +0100, Libor Vanek wrote: > > > >My guess is that the filesystem change notification would be a better > > > >solution, either in userspace or in kernelspace, doesn't matter. But > > > >that is far from finished or even generally accepted. > > > > > > This is also something (but just a bit) different - I don't need "change > > > notification" but "pre-change notification" ;) > > > > "Vor dem Spiel ist nach dem Spiel" -- Sepp Herberger > > > > Except for exactly two cases, pre-change and post-change and the same, > > just off-by-one. So you would need a bootup/mount/whenever special > > case now, is that a big problem? > > Probably my english is bad but I don't understand what are you trying to say (except the german part ;-)) > A bit more about pre/post-change (if this is what are you trying to say) - I need allways pre-change because after file is changed I can no longer get original (pre-change) version of file which I need for snapshot.
then you are off on the wrong track anyway since filedata can change without system call anyway (think mmaped file where the dirtying doesnt' involve a syscall [unhandled content-type:application/pgp-signature] | |