Messages in this thread | | | From | Jesse Pollard <> | Subject | Re: The disappearing sys_call_table export. | Date | Thu, 8 May 2003 09:56:49 -0500 |
| |
On Thursday 08 May 2003 09:08, Chuck Ebbert wrote: > Al Viro wrote: > >> > I'd make a stab at it if I knew that it stood a chance of getting > >> > accepted. > >> > >> I dont think it has. > > > > I think it could, actually - who maintains fortunes these days? It's > > a bit too long, though... > > Wow, Advanced Sarcasm. Must be part of the Graduate program... > > Meanwhile on Win2k I can intercept any IO request by > wrting a filter driver, and that driver can get control on the way > back to userspace by registering a completion routine. Such filters > can be arbitrarily chained together and can be placed either above or > below an FSD, making such things as virus detection, HSM and disk > mirroring much easier to write...
note the key word in the phrase "filter DRIVER". Linux modules can intercep any I/O directed toward them. and the filesystem layer can intercept any filesystem call. And there are filesystem modules.
M$ seems to treat everything as a disk file (even "pipes" are implemented as temporary files).
Have you tried catching the display IO ???
HSM has existed on UNIX based machines for a long time.
> How would I do this on Linux? How would virus detection and HSM > coexist? (HSM would have to be 'above' the virus detector, since it > makes no sense to try and scan a file that's been migrated until it > gets recalled back to disk.)
I would expect the same way the NFS module interceps file system calls.
There is NO reason a custom filesystem cannot be layered over other filesystems. It might not be done today (though the references to "userfs" keep showing up in such discussions).
I do question the validity of virus detection though. Once examined, fix the vulnerability. No more virus.
Virus detection can never be completely done. And it imposes a constantly increasing overhead since you must be able to identify all pre-existing viruses. This list of "pre-existing" will be constantly growing.
Fix the vulnerability. Then there won't be a virus. - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |