| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <CAOh0hwNt7bDf5zJy086U=QcMa_5HCMv_KOKmeGnisb8hF3Eujw@mail.gmail.com> Date: Fri, 23 Dec 2011 22:37:32 +0530 From: Gaurav Saxena <grvsaxena419@...il.com> To: Alan Cox <alan@...rguk.ukuu.org.uk> Cc: John Stoffel <john@...ffel.org>, richard -rw- weinberger <richard.weinberger@...il.com>, linux-kernel@...r.kernel.org Subject: Re: Intercepting system calls Hello Alan On Fri, Dec 23, 2011 at 8:20 PM, Alan Cox <alan@...rguk.ukuu.org.uk> wrote: >> Write a FUSE module to mount the filesystem through, inside your FUSE >> module you can intercept the unlink/truncate/write calls and decide >> what you want to have happen. > > Using fanotify and/or a custom security module (or selinux rules) might > well also be a cleaner way to do it, depending what is actually intended. > > Trying to do stuff like archive 'old versions' isn't just about unlink > however because many programs update the inplace file rather than > unlink/replace. I will see what SELinux offers but as far as I know I would need a kernel recompile/ reinstall for that which most of the users would avoid. I would still try doing these if I don't find any other way, but still kprobes seemed a better way but ubuntu kernel does not enable them. -- Thanks and Regards , Gaurav -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists