Messages in this thread | | | From | Gaurav Saxena <> | Date | Fri, 23 Dec 2011 22:37:32 +0530 | Subject | Re: Intercepting system calls |
| |
Hello Alan
On Fri, Dec 23, 2011 at 8:20 PM, Alan Cox <alan@lxorguk.ukuu.org.uk> wrote: >> Write a FUSE module to mount the filesystem through, inside your FUSE >> module you can intercept the unlink/truncate/write calls and decide >> what you want to have happen. > > Using fanotify and/or a custom security module (or selinux rules) might > well also be a cleaner way to do it, depending what is actually intended. > > Trying to do stuff like archive 'old versions' isn't just about unlink > however because many programs update the inplace file rather than > unlink/replace. I will see what SELinux offers but as far as I know I would need a kernel recompile/ reinstall for that which most of the users would avoid. I would still try doing these if I don't find any other way, but still kprobes seemed a better way but ubuntu kernel does not enable them.
-- Thanks and Regards , Gaurav
| |