filesystems - Intercepting disk write in Linux -
i want intercept every disk write operation in linux server. in detail, want catch every disk write operation right @ time when happens , able work out process initiated call, trying write , on. make simple, now, concentrating on ext3 only. aware of auditfs , other 'watchers' let know once operation has happened. said earlier, want intercept happens , able retrieve information operation (process information, target location, content being written). if there interrupt/call kind of mechanism (for example receiving notification of write operation process, process group or session - pid, pgid, sid), better.
thanks
i did searching on issue, , these promising: • copyhook handlers - msdos shell, lodge interception dll in winreg • ntsetinformationfile • minifilters - think these portable cross-platform • installable file system drivers - well, of course
file share type: filesystems support audit , protection hardening, may "after-the-fact".
copyhook looks promisingly simple: intercepting shell file manipulation calls in windows:
https://msdn.microsoft.com/en-us/library/bb776048.aspx
the driver-level stuff gets hairy, ...
Comments
Post a Comment