I would like to make a piece of code which is able to know when another application is trying to open or write a file, and also able to prevent this access. Is it possible ? How ?

For example, for a zip file containing a video, Opening the file with VLC would lead my tool to prevent VLC to open the file, unzip the archive in a temporary folder and re-open the video with vlc.

I'm not interested on how bad this idea is, it's more about personal curiosity and technical challenge. And it's not about zip and VLC, it's my own file container.

I'm new to the Linux Kernel.

  • 1
    Try this superuser.com/questions/181517/… . (And a couple search terms to start out with: linux file locking and linux file watcher) – B Layer Sep 25 '17 at 13:35
  • It's certainly possible, that's how FUSE filesystems work. But you'll need some programming experience to do what you want. – Satō Katsura Sep 25 '17 at 13:44
  • You may be a bit more specific in a sense that many things that you may not think of as files are, technically, files in UNIX-like systems. For example, stdout is a file, pipes are files etc. There are a lot of "fake" files (on modern Linux system, /sys and /dev are just interfaces to system code, not actual files.) Also, accessing files may mean different things: does stat file access it? does mv file access it? – wvxvw Sep 25 '17 at 14:17
  • selinux can likely do the prevention of access thing; SystemTap or sysdig if all you need is a log report or something when the access happens – thrig Sep 25 '17 at 14:24
  • 1
    You would need fanotify, not inotify, if you wanted to intercept the access and prevent it (inotify can only watch for access, it can't stop it). Regardless of using that or FUSE though, it would need to delay the access until the transformation is done, not deny it, otherwise you need to update the application accessing it to retry after some time period. – Austin Hemmelgarn Sep 25 '17 at 15:47

Linux Security Modules are designed to control access to resources such as files:

LSM was designed to provide the specific needs of everything needed to successfully implement a mandatory access control module ... LSM inserts "hooks" (upcalls to the module) at every point in the kernel where a user-level system call is about to result in access to an important internal kernel object such as inodes and task control blocks.

To implement this, I think you'd have to create a device driver that would pass events such as "open() has been called. VLC is opening a zip file with a video in it" to a user-space process that would unzip the appropriate file and return the name of the unzipped file, which your LSM module would then pass onward to the actual kernal open call. And then on the corresponding close() call you'd pass that event from your LSM module up to your user-space process so it could delete the unzipped video file.

It's not a trivial undertaking. Among other things, you'll need to be really careful you don't introduce huge security holes: "Hey, this thing can be used to rewrite /etc/shadow!"

  • At least since Solaris-10 it is possible to use event ports. – schily Jun 28 '18 at 12:36

I am not sure whether the default Solaris features would allow to monitor open() calls, but it is possible to monitor write access.

Check the man pages for e.g. port_create() and have a look into /usr/include/port.h.

It may also be of interest to check usr/src/cmd/tail on Illumos for the tail -f implementation that is event driven.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.