Re: Reading from file in module fails

Pascal Schmidt
2004-05-03T16:55:32Z

On Mon, 03 May 2004 14:50:10 +0200, you wrote in linux.kernel:

> That can all be done in userspace.
>
> $ export LD_PRELOAD=3Dlibcopyfilesbeforemodify.so
>
> You just need to program a library that provides all functions that
> modify files (eg. write, open with O_CREAT, ...) and you're done - 100%
> in userspace.

This won't catch asm programs that do syscalls by hand or statically
linked programs. If you really need to catch all write accesses, it
needs to be done in the kernel, probably as an LSM hook or something.

--
Ciao,
Pascal