filesystems - Intercepting disk write in Linux -


i want intercept every disk write operation in linux server. in detail, want catch every disk write operation right @ time when happens , able work out process initiated call, trying write , on. make simple, now, concentrating on ext3 only. aware of auditfs , other 'watchers' let know once operation has happened. said earlier, want intercept happens , able retrieve information operation (process information, target location, content being written). if there interrupt/call kind of mechanism (for example receiving notification of write operation process, process group or session - pid, pgid, sid), better.

thanks

i did searching on issue, , these promising: • copyhook handlers - msdos shell, lodge interception dll in winreg • ntsetinformationfile • minifilters - think these portable cross-platform • installable file system drivers - well, of course

file share type: filesystems support audit , protection hardening, may "after-the-fact".

copyhook looks promisingly simple: intercepting shell file manipulation calls in windows:

https://msdn.microsoft.com/en-us/library/bb776048.aspx

the driver-level stuff gets hairy, ...


Comments

Popular posts from this blog

assembly - 8086 TASM: Illegal Indexing Mode -

Java, LWJGL, OpenGL 1.1, decoding BufferedImage to Bytebuffer and binding to OpenGL across classes -

javascript - addthis share facebook and google+ url -