site_archiver@lists.apple.com Delivered-To: darwin-kernel@lists.apple.com <http://developer.apple.com/qa/qa2001/qa1242.html> Are you implying that there's no way to identify a directory entry by the handle that gets passed to a FS write call? <http://www.apple.com/support/downloads/commoncriteriatools.html> <http://www.apple.com/support/downloads/commoncriteriatoolsfor104.html> Alternatively, in kernel, you can look at the service's provided by Kauth. <http://developer.apple.com/technotes/tn2004/tn2127.html> <http://developer.apple.com/samplecode/KauthORama/KauthORama.html> S+E -- Quinn "The Eskimo!" <http://www.apple.com/developer/> Apple Developer Technical Support * Networking, Communications, Hardware _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel@lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.a... At 9:26 +0200 6/7/05, Thomas Tempelmann wrote: I've heard several times the term "stackable file system". Stackability in Mac OS X is a myth. It was part of 4.4 BSD, but it has never been properly supported in Mac OS X. There is (via the F_GETPATH selector to fcntl <x-man-page://2/fcntl>), but it's not 100% reliable. We keep track of the path that was traversed to open the file system object (including ongoing tracking of any renames along that path), but there are situations where this doesn't work. The most common one is a file that's created, opened, and then deleted. In traditional Mac OS you can't delete a file that's open, but in UNIX this is a common programming paradigm for temporary files. It's self evident that you can't get a valid path to a file descriptor (or vnode, if you're in the kernel) for a deleted file. If you just want to log file system activities, you should look at the audit support that was introduced in Mac OS X 10.3.x. Intercepting (and potentially changing) file system operations isn't something that we have a general solution for. This email sent to site_archiver@lists.apple.com