Re: FileSystem Filter Driver

From: Michael Knigge (Michael.Knigge@set-software.de)
Date: Wed Apr 23 2003 - 06:47:39 EST


Hi,

> What's a FileSystem Filter Driver?

This is a driver that intercepts calls to the filesystem - for example
for monitoring or to do additional access checks. Such a filter driver
can then pass the call down to the filesystem or just cancel the call
and (for example) return "access denied".

Under Windows a pretty well-known filter driver is FileMon at
www.sysinternals.com. Thex also have a Linux version but (ahhh)
without Source (the source for the Windows-Version is available). The
Linux-Version can be found at
http://www.sysinternals.com/linux/utilities/filemon.shtml

I guess what they are doing is similar to the way strace works - but
I'm not sure. Hmmm, let us strace this thing ;-))))

Here are two Links that might help to implement such a thing under
Linux (the most interesting is DaZuKo):

http://www.dazuko.org/
http://oss.sgi.com/projects/fam/

Bye
  Michael

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/



This archive was generated by hypermail 2b29 : Wed Apr 23 2003 - 22:00:36 EST