Re: Syscall table AKA hijacking syscalls

[Arjan van de Ven <arjanv@redhat.com>]

[-- Attachment #1: Type: text/plain, Size: 1291 bytes --]

On Fri, 2004-01-02 at 19:58, Libor Vanek wrote:
> On Fri, Jan 02, 2004 at 07:04:31PM +0100, Jörn Engel wrote:
> > On Fri, 2 January 2004 17:59:22 +0100, Libor Vanek wrote:
> > > >My guess is that the filesystem change notification would be a better
> > > >solution, either in userspace or in kernelspace, doesn't matter.  But
> > > >that is far from finished or even generally accepted.
> > > 
> > > This is also something (but just a bit) different - I don't need "change 
> > > notification" but "pre-change notification" ;)
> > 
> > "Vor dem Spiel ist nach dem Spiel" -- Sepp Herberger
> > 
> > Except for exactly two cases, pre-change and post-change and the same,
> > just off-by-one.  So you would need a bootup/mount/whenever special
> > case now, is that a big problem?
> 
> Probably my english is bad but I don't understand what are you trying to say (except the german part ;-))
> A bit more about pre/post-change (if this is what are you trying to say) - I need allways pre-change because after file is changed I can no longer get original (pre-change) version of file which I need for snapshot.

then you are off on the wrong track anyway since filedata can change
without system call anyway (think mmaped file where the dirtying doesnt'
involve a syscall

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]