Re: Intercepting system calls

["John Stoffel" <john@stoffel.org>]

>>>>> "Gaurav" == Gaurav Saxena <grvsaxena419@gmail.com> writes:

Gaurav> Hello John,
Gaurav> On Thu, Dec 22, 2011 at 11:22 PM, John Stoffel <john@stoffel.org> wrote:
>>>>>>> "Gaurav" == Gaurav Saxena <grvsaxena419@gmail.com> writes:
>> 
>>>> Intercepting system calls is very bad, don't do it.
>> 
Gaurav> Oh. I will not do it then, could you suggest me something so
Gaurav> that I could prevent unlink on some file say using kernel
Gaurav> support. I want to save file on unlink how could I do that
Gaurav> without kernel support, or how could I do that using a kernel
Gaurav> module.
>> 
>> Write a FUSE module to mount the filesystem through, inside your FUSE
>> module you can intercept the unlink/truncate/write calls and decide
>> what you want to have happen.

Gaurav> I would like to write it differently for each type of filesystem ?
Gaurav> Because what operations to call after my function depends on this.
Gaurav> Also Can I mount "/" in this way ?

Sounds like you really want to use inotify() then, but intercepting
calls to write/truncate/unlink isn't going to be easy to handle across
a large spectrum of filesystems without a bunch of hacking.  

Maybe if you can explain your requirements more clearly, with an
example of what you're trying to accomplish, then people could help
you more.

Also, it might be more appropriate to talk to the 'fs-devel' mailing
list.  I think it's on kernel.org, but not sure.

John