Re: interception of file system function calls...
Re: interception of file system function calls...
- Subject: Re: interception of file system function calls...
- From: Boris Remizov <email@hidden>
- Date: Thu, 24 Jan 2008 14:48:05 +0400
Oh... and if you want to restrict the access to file objects of
filesystem you may use kauth mechanism. KauthORama is a good sample
project by apple.
On Jan 24, 2008, at 2:43 PM, Boris Remizov wrote:
Documentation for VFS is very scarce, and this approach in not-
documented due it's xnu version dependent. So I can't recommend
anything than swimming in xnu sources...
On Jan 24, 2008, at 2:20 PM, lh wrote:
Hmmm, is there any documentation how to do this? I've not the
slightest idea and i didn't find anything...
Boris Remizov wrote:
Hello,
In 10.4, 10.5 the syscalls table symbol was hidden. So to
intercept file system calls you should patch the VOPFUNC table
that can be accessed at path
TAILQ_FIRST(mount::mnt_vnodelist)->v_op. The index of intercepted
function stored in field of static structures
vnop_XXX_desc.vdesc_offset, where XXX is 'open'. 'close', 'read',
'write', etc... All this symbols and data types are defined in xnu
source.
On Jan 23, 2008, at 9:02 PM, lh wrote:
Hi everyone,
i'm searching for a way to override the normal calls to commands
like rm (or better: the underlying functions). What i want to
achieve with this is similar to the Linux libtrash library (http://pages.stern.nyu.edu/~marriaga/software/libtrash/
). So far i did not find anything similar for OS X. Has anyone
done something like this before or has any hints?
Thanks a lot.
Cheers,
Lutz.
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Filesystem-dev mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:
This email sent to email@hidden