Re: The disappearing sys_call_table export.

[Jesse Pollard <jesse@cats-chateau.net>]

On Thursday 08 May 2003 09:08, Chuck Ebbert wrote:
> Al Viro wrote:
> >> > I'd make a stab at it if I knew that it stood a chance of getting
> >> > accepted.
> >>
> >> I dont think it has.
> >
> > I think it could, actually - who maintains fortunes these days?  It's
> > a bit too long, though...
>
>   Wow, Advanced Sarcasm.  Must be part of the Graduate program...
>
>   Meanwhile on Win2k I can intercept any IO request by
> wrting a filter driver, and that driver can get control on the way
> back to userspace by registering a completion routine.  Such filters
> can be arbitrarily chained together and can be placed either above or
> below an FSD, making such things as virus detection, HSM and disk
> mirroring much easier to write...

note the key word in the phrase "filter DRIVER". Linux modules can intercep
any I/O directed toward them. and the filesystem layer can intercept any
filesystem call. And there are filesystem modules.

M$ seems to treat everything as a disk file (even "pipes" are implemented
as temporary files).

Have you tried catching the display IO ???

HSM has existed on UNIX based machines for a long time.

>   How would I do this on Linux?  How would virus detection and HSM
> coexist?  (HSM would have to be 'above' the virus detector, since it
> makes no sense to try and scan a file that's been migrated until it
> gets recalled back to disk.)

I would expect the same way the NFS module interceps file system calls.

There is NO reason a custom filesystem cannot be layered over other 
filesystems. It might not be done today (though the references to "userfs"
keep showing up in such discussions).

I do question the validity of virus detection though. Once examined, fix the
vulnerability. No more virus.

Virus detection can never be completely done. And it imposes a constantly 
increasing overhead since you must be able to identify all pre-existing 
viruses. This list of "pre-existing" will be constantly growing.

Fix the vulnerability. Then there won't be a virus.