Re: FileSystem Filter Driver

[Michael Knigge]

Hi,

> What's a FileSystem Filter Driver?

This is a driver that intercepts calls to the filesystem - for example 
for monitoring or to do additional access checks. Such a filter driver 
can then pass the call down to the filesystem or just cancel the call 
and (for example) return "access denied".

Under Windows a pretty well-known filter driver is FileMon at 
www.sysinternals.com. Thex also have a Linux version but (ahhh) 
without Source (the source for the Windows-Version is available). The 
Linux-Version can be found at 
http://www.sysinternals.com/linux/utilities/filemon.shtml

I guess what they are doing is similar to the way strace works - but 
I'm not sure. Hmmm, let us strace this thing ;-))))

Here are two Links that might help to implement such a thing under 
Linux (the most interesting is DaZuKo):

http://www.dazuko.org/
http://oss.sgi.com/projects/fam/

Bye
  Michael