I am writing an application for which I need to intercept some filesystem system calls eg. unlink. I would like to save some file say abc. If user deletes the file then I need to copy it to some other place. So I need unlink to call my code before deleting abc so that I could save it. I have gone through threads related to intercepting system calls but methods like LD_PRELOAD it wont work in my case because I want this to be secure and implemented in kernel so this method wont be useful. inotify notifies after the event so I could not be able to save it. Could you suggest any such method. I would like to implement this in a kernel module instead of modifying kernel code itself. Another method as suggested by Graham Lee, I had thought of this method but it has some problems ,I need hardlink mirror of all the files it consumes no space but still could be problematic as I have to repeatedly mirror drive to keep my mirror up to date, also it won't work cross partition and on partition not supporting link so I want a solution through which I could attach hooks to the files/directories and then watch for changes instead of repeated scanning. I would also like to add support for write of modified file for which I cannot use hard links. I would like to intercept system calls by replacing system calls but I have not been able to find any method of doing that in linux > 3.0. Please suggest some method of doing that.

share|improve this question
up vote 5 down vote accepted

As far as hooking into the kernel and intercepting system calls go, this is something I do in a security module I wrote:

https://github.com/cormander/tpe-lkm

Look at hijacks.c and symbols.c for the code; how they're used is in the hijack_syscalls function inside security.c. I haven't tried this on linux > 3.0 yet, but the same basic concept should still work.

It's a bit tricky, and you may have to write a good deal of kernel code to do the file copy before the unlink, but it's possible here.

share|improve this answer
    
Hello Thanks for your reply. I tried compiling it on system with linux 3.0.0.13 but it did not compile it gave some error error: unknown field ‘ctl_name’ but It compiled on linux 2.6.32 I will try using it on that system and see if I could make use of it. – gaurav Dec 23 '11 at 9:17
    
The ctl_name is part of the sysctl configuration code, so it's not necessary for the hijack sections of the code to work. I'll eventually port the code to 3.x – Corey Henderson Dec 23 '11 at 15:45
    
That will be nice of you, could you give me some pointers regarding what approach you are using or I dive into the code to see that. If I get an idea I would port it. – gaurav Dec 24 '11 at 5:11
1  
I just posted an overview of how it works - cormander.com/2011/12/… – Corey Henderson Dec 24 '11 at 6:28
    
Hello, Thanks a lot for the overview I have gone through it. Nicely written overview thanks a lot. You have done a total hack on the kernel. Have you inspired from kprobe code ? Can we skip the system call completely ? – gaurav Dec 26 '11 at 6:27

You can watch unlink events with inotify, though this might happen too late for your purposes (I don't know because I don't know your purposes, and you should experiment to find out). The in-kernel alternatives based on LSM (by which I mean SMACK, TOMOYO and friends) are really for Mandatory Access Control so may not be suitable for your purposes.

share|improve this answer
    
Thanks for your answer, I have edited the question. – gaurav Dec 21 '11 at 17:08

One suggestion could be Filesystems in Userspace (FUSE.) That is, write a FUSE module (which is, granted, in userspace) which intercepts filesystem-related syscalls, performs whatever tasks you want, and possibly calls the "default" syscall afterwards.

You could then mount certain directories with your FUSE filesystem and, for most of your cases, it seems like the default syscall behavior would not need to be overridden.

share|improve this answer
1  
Thanks for your answer , can I mount / using FUSE filesystem. Would I need to replace all the filesystem calls individually as I think VFS will call my FUSE filesystem it would need to come in between say VFS and ext4. Am I right ? – gaurav Dec 21 '11 at 17:30

If you want to handle deletions only, you could keep a "shadow" directory of hardlinks (created via link) to the files being watched (via inotify, as suggested by Graham Lee).

If the original is now unlinked, you still have the shadow file to handle as you want to, without using a kernel module.

share|improve this answer
    
I have edited the question , Please could you suggest something now. – gaurav Dec 21 '11 at 17:10
    
Is it possible for you to change your mount points? if so, It may be possible to write a FUSE filesystem. You may want to have a look at collectfs which might do what you want. – Hasturkun Dec 21 '11 at 17:22
    
No I won't be able to change mount points every time like if I want to work on "/" this won't be possible. I will see collectfs. – gaurav Dec 21 '11 at 17:33
    
If you can mount at all, you could make the application run in a chroot jail, have your FUSE fs mirror /, It's probably still easier to do than to implement a kernel module. – Hasturkun Dec 21 '11 at 17:51
    
I think this could work for me, would I be able to intercept open/ link system call too. Would I need to replace all the filesystem calls individually as I think VFS will call my FUSE filesystem it would need to come in between say VFS and ext4. Am I right ? Also if I mount / ie. the root partition I won't be able to see removable drives and updated changes. Would I ? – gaurav Dec 22 '11 at 3:57

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.