Re: Intercepting system calls

From: Alan Cox
Date: Fri Dec 23 2011 - 09:50:41 EST


> Write a FUSE module to mount the filesystem through, inside your FUSE
> module you can intercept the unlink/truncate/write calls and decide
> what you want to have happen.

Using fanotify and/or a custom security module (or selinux rules) might
well also be a cleaner way to do it, depending what is actually intended.

Trying to do stuff like archive 'old versions' isn't just about unlink
however because many programs update the inplace file rather than
unlink/replace.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/