site_archiver@lists.apple.com Delivered-To: darwin-kernel@lists.apple.com On Jun 15, 2007, at 10:40 AM, Amanda Walker wrote: = Mike _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel@lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.a... On Jun 15, 2007, at 9:45 AM, Michael Smith wrote: If your product's aim is to have a complete backup copy of everything, then you are better off waiting in the FILEOP scope for last-close notifications with the modified flag set. This gives you both the indication that the file is not being modified, and an indication that it previously has been. Right--but this is doing the copy after each modification (so you'll have it already saved away when the next modification happens), not on-demand just before the change, which is what Yogesh was asking for. Yes - sorry, I should have been more clear. You can get a hook in before the change happens with KAUTH, but you don't have enough information at that point to do anything useful with the file. But you're quite right--if you're willing to do "backup just after each change" instead of "backup just before each change", hooking FILEOP scope in a Kauth module works very well. I did a little more thinking about the implementation, and it would be very hard for the kernel to offer a service that fully facilitates what Yogesh is trying to do without special-casing a lot of things. One principle the kernel tries to adhere to is that individual operations are, as much as possible, agnostic of the wider context in which they are being performed, and it is knowledge of a number of aspects of that context that are required to determine an impending change from "not modified" to "modified". This email sent to site_archiver@lists.apple.com