Re: [OT] inotify hack for locate

Jon Masters
2006-03-06T13:10:41Z

On 3/6/06, Helge Hafting <helge.hafting@aitel.hist.no> wrote:
> Jon Masters wrote:
>
> >You're right. What I want really is to be able to bind to a netlink
> >socket and get told about particular file IO operations I'm interested
> >in for the /whole/ of a filesystem. The same kind of thing that real
> >time anti-virus/anti-spam people want to do anyway.

> Do they?
> I thought all this mail processing could be done in the mailserver
> and/or mail reader. Why detect spam by looking for generic file
> creation when you can trivially tap into mail as it arrives?

Because it's not just email :-) These guys want to be able to filter
/every/ file no matter how it is accessed.

> As for the non-existent virus problem - it is mostly prevented
> by users not being administrators. And you can go further
> with a readonly /usr and a noexec /home.

That's definately OT - I was simply saying that there are
anti-spam/anti-virus products which run on Linux that use hooks to do
this at the VFS level. So that you don't need to modify
Samba/Mailserver/NFS/everything else.

Jon.