Re: Syscall table AKA hijacking syscalls

[Libor Vanek <libor@conet.cz>]

Arjan van de Ven wrote:
> On Fri, 2004-01-02 at 19:58, Libor Vanek wrote:
> 
>>On Fri, Jan 02, 2004 at 07:04:31PM +0100, Jörn Engel wrote:
>>
>>>On Fri, 2 January 2004 17:59:22 +0100, Libor Vanek wrote:
>>>
>>>>>My guess is that the filesystem change notification would be a better
>>>>>solution, either in userspace or in kernelspace, doesn't matter.  But
>>>>>that is far from finished or even generally accepted.
>>>>
>>>>This is also something (but just a bit) different - I don't need "change 
>>>>notification" but "pre-change notification" ;)
>>>
>>>"Vor dem Spiel ist nach dem Spiel" -- Sepp Herberger
>>>
>>>Except for exactly two cases, pre-change and post-change and the same,
>>>just off-by-one.  So you would need a bootup/mount/whenever special
>>>case now, is that a big problem?
>>
>>Probably my english is bad but I don't understand what are you trying to say (except the german part ;-))
>>A bit more about pre/post-change (if this is what are you trying to say) - I need allways pre-change because after file is changed I can no longer get original (pre-change) version of file which I need for snapshot.
> then you are off on the wrong track anyway since filedata can change
> without system call anyway (think mmaped file where the dirtying doesnt'
> involve a syscall

I know about this - the only (simple and fast enough) solution is to copy (backup) file whenever it's open for writing and mmap is called.


-- 

Libor Vanek