Messages in this thread | | | From | Gaurav Saxena <> | Date | Fri, 23 Dec 2011 22:33:45 +0530 | Subject | Re: Intercepting system calls |
| |
Hello all , thanks for your reply.
On Fri, Dec 23, 2011 at 8:08 PM, John Stoffel <john@stoffel.org> wrote: >>>>>> "Gaurav" == Gaurav Saxena <grvsaxena419@gmail.com> writes: > > Gaurav> Hello John, > Gaurav> On Thu, Dec 22, 2011 at 11:22 PM, John Stoffel <john@stoffel.org> wrote: >>>>>>>> "Gaurav" == Gaurav Saxena <grvsaxena419@gmail.com> writes: >>> >>>>> Intercepting system calls is very bad, don't do it. >>> > Gaurav> Oh. I will not do it then, could you suggest me something so > Gaurav> that I could prevent unlink on some file say using kernel > Gaurav> support. I want to save file on unlink how could I do that > Gaurav> without kernel support, or how could I do that using a kernel > Gaurav> module. >>> >>> Write a FUSE module to mount the filesystem through, inside your FUSE >>> module you can intercept the unlink/truncate/write calls and decide >>> what you want to have happen. > > Gaurav> I would like to write it differently for each type of filesystem ? > Gaurav> Because what operations to call after my function depends on this. > Gaurav> Also Can I mount "/" in this way ? > > Sounds like you really want to use inotify() then, but intercepting > calls to write/truncate/unlink isn't going to be easy to handle across > a large spectrum of filesystems without a bunch of hacking. > > Maybe if you can explain your requirements more clearly, with an > example of what you're trying to accomplish, then people could help > you more. > > Also, it might be more appropriate to talk to the 'fs-devel' mailing > list. I think it's on kernel.org, but not sure. > > John >
I am trying to write an application which would create a backup for the system so that it could be restored as it is. For example I create a backup using my application. I just do nothing at time of backup so it would be fast. Now whenever I see any deletion I would save that file so that I could restore it. Also I would like to see for modification/rename. I cannot do this using inotify as I would be notified after actual deletion/write. I don't want to use SELinux because I want to implement this on existing installed system. I was earlier thinking of replacing system calls for open/unlink with my custom calls which will call my functions before actual work and then I would decide what to do I would also want to reject unlink request for some of the files. But as I now know that its not working in linux>3.0 . I had also seen dazuko which is not supporting linux>3.0 yet. Also there used to be a redirfs which used to work earlier but the latest kernel is not supported yet. So I asked this question so that I could get some solution/method of doing this. I will try finding fs-devel list. Thanks to you all for your help.
-- Thanks and Regards , Gaurav -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |