linux-kernel - Re: Intercepting system calls

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 23 Dec 2011 09:38:10 -0500
From:	"John Stoffel" <john@...ffel.org>
To:	Gaurav Saxena <grvsaxena419@...il.com>
Cc:	John Stoffel <john@...ffel.org>,
	richard -rw- weinberger <richard.weinberger@...il.com>,
	linux-kernel@...r.kernel.org
Subject: Re: Intercepting system calls

>>>>> "Gaurav" == Gaurav Saxena <grvsaxena419@...il.com> writes:

Gaurav> Hello John,
Gaurav> On Thu, Dec 22, 2011 at 11:22 PM, John Stoffel <john@...ffel.org> wrote:
>>>>>>> "Gaurav" == Gaurav Saxena <grvsaxena419@...il.com> writes:
>> 
>>>> Intercepting system calls is very bad, don't do it.
>> 
Gaurav> Oh. I will not do it then, could you suggest me something so
Gaurav> that I could prevent unlink on some file say using kernel
Gaurav> support. I want to save file on unlink how could I do that
Gaurav> without kernel support, or how could I do that using a kernel
Gaurav> module.
>> 
>> Write a FUSE module to mount the filesystem through, inside your FUSE
>> module you can intercept the unlink/truncate/write calls and decide
>> what you want to have happen.

Gaurav> I would like to write it differently for each type of filesystem ?
Gaurav> Because what operations to call after my function depends on this.
Gaurav> Also Can I mount "/" in this way ?

Sounds like you really want to use inotify() then, but intercepting
calls to write/truncate/unlink isn't going to be easy to handle across
a large spectrum of filesystems without a bunch of hacking.  

Maybe if you can explain your requirements more clearly, with an
example of what you're trying to accomplish, then people could help
you more.

Also, it might be more appropriate to talk to the 'fs-devel' mailing
list.  I think it's on kernel.org, but not sure.

John

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/