Re: FileSystem Filter Driver

["Leonard Milcin, Jr" <thervoy@post.pl>]

Michael Knigge wrote:
> Hi,
> 
> 
>>What's a FileSystem Filter Driver?
> 
> 
> This is a driver that intercepts calls to the filesystem - for example 
> for monitoring or to do additional access checks. Such a filter driver 
> can then pass the call down to the filesystem or just cancel the call 
> and (for example) return "access denied".

Nice. I wonder if there is some open-source project with aim in building
audit tool based on that idea. It will be very nice to have one, and I 
think it will be very interesting, especially for corporate users. I 
will search for information about this, and if I find nothing, maybe 
this is a good moment to start that project? The aim will be building 
kernel driver + user-space tool to provide 1) ultimate filesystem audit 
tool, 2) user space access control manager. This will help linux to 
conquer with proprietary products.

What you're thinking about it?



Leonard,