Hello Rajat Thanks for your reply. On Mon, Dec 26, 2011 at 11:23 AM, Rajat Sharma <fs.rajat@xxxxxxxxx> wrote: > Hi Gaurav, > > I would suggest to take a wrapfs source (a null stackable file-system) > and customize it for your need. Well Erez (wrapfs author) puts his > continuous efforts in stabilizing wrapfs and porting to new kernels > and he is approachable too. In-fact he has acknowledged on of my patch > and merged it into wrapfs tree. Is there a way to mount "/" on such file system ? Like I want to monitor / for changes like unlink or modified write. Would I be able to see such changes using wrapfs. As by default on the systems "/" would be mounted as ext4 filesystem. > > Agreed that you can do stuffs like patching system call table but I > (and most of us here) would categorize that as pure hack, as there > exist no framework provided by kernel to do that. Also any approach > you take to patch system call table won't be stable. Yes I agree with you I want to do this using a method which is not a hack, so that the support remains with all the versions of kernel rather than a trick that works in a limited way. > > Thanks, > Rajat > > On Sat, Dec 24, 2011 at 2:39 PM, Gaurav Saxena <grvsaxena419@xxxxxxxxx> wrote: >> Hello all, >> >> I am writing an application which would create a backup for the system >> so that it could be restored as it is. For example I create a backup >> using my application. I just do nothing at time of backup so it would >> be fast. Now whenever I see any deletion I would save that file so >> that I could restore it. Also I would like to see for >> modification/rename. I cannot do this using inotify as I would be >> notified after actual deletion/write. I don't want to use SELinux >> because I want to implement this on existing installed system. I was >> earlier thinking of replacing system calls for open/unlink with my >> custom calls which will call my functions before actual work and then >> I would decide what to do I would also want to reject unlink request >> for some of the files. But as I now know that its not working in >> linux>3.0 . I had also seen dazuko which is not supporting linux>3.0 >> yet. Also there used to be a redirfs which used to work earlier but >> the latest kernel is not supported yet. I think a method could be to >> replace unlink in syscall table with my unlink function but I don't >> find any good method of doing that, as syscall table is no longer >> exported. I would like to implement this in a kernel module instead of >> modifying kernel code itself. Please suggest some method of doing >> that. >> Thanks to you all for your help. >> >> -- >> Thanks and Regards , >> Gaurav >> -- >> To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in >> the body of a message to majordomo@xxxxxxxxxxxxxxx >> More majordomo info at http://vger.kernel.org/majordomo-info.html -- Thanks and Regards , Gaurav -- To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
