Re: Syscall table AKA hijacking syscalls

Libor Vanek
2004-01-02T19:00:15Z

On Fri, Jan 02, 2004 at 07:04:31PM +0100, Jörn Engel wrote:
> On Fri, 2 January 2004 17:59:22 +0100, Libor Vanek wrote:
> > >My guess is that the filesystem change notification would be a better
> > >solution, either in userspace or in kernelspace, doesn't matter. But
> > >that is far from finished or even generally accepted.
> >
> > This is also something (but just a bit) different - I don't need "change
> > notification" but "pre-change notification" ;)
>
> "Vor dem Spiel ist nach dem Spiel" -- Sepp Herberger
>
> Except for exactly two cases, pre-change and post-change and the same,
> just off-by-one. So you would need a bootup/mount/whenever special
> case now, is that a big problem?

Probably my english is bad but I don't understand what are you trying to say (except the german part ;-))
A bit more about pre/post-change (if this is what are you trying to say) - I need allways pre-change because after file is changed I can no longer get original (pre-change) version of file which I need for snapshot.

> > >For the diploma thesis, feel free to use any hack you like, including
> > >hijacking syscalls. But remember that it is a hack and nothing else,
> > >only helping you to remain on schedule and focus more on the real
> > >subject. And don't plan on kernel acceptance either, as you will fail
> > >either that or the thesis and I'd choose the thesis.
> >
> > You're absolutely right but when I'm going to spent several weeks on
> > something like this I'd like to do something usefull - not something
> > which will be trashed after exam. So I'm trying to find out some
> > "politically correct" way.
>
> Then seperate the two problems. One is to figure out, what has
> changed and two is to act accordingly. Two should be pretty
> independent on this threads subject. If that part is really useful,
> people will help you on problem one. Postpone. :)
> ...
> Ok, back to your problem. Seperation is the way to go. Problem one
> is a hard one and it takes a lot of time to do right. But hacking it
> up is quite simple, so you can save time with the hack and do it right
> only if your solution to problem two proved good enough.

Yes - that's what I'm now doing. Just now I'm going to reboot my machine (<grr>) and try if EXPORT_SYMBOL(sys_open) works as I think it should ;)

Anyway - thanks for hints.

--
Libor Vanek