I want to trap the below operations on a Linux system. Is it possible to do so efficiently? My end goal is to provide auditing and an additional set of filesystem metadata that is indexed differently. If the answer is "no", I appreciate pointers in a useful direction.
1) open(), and its parameters (where flags is O_CREAT) 2) write(), along with its parameters, *buf, and the struct file for fd, including f_pos 3) the corresponding information in 2 for a memory-mapped write to a file. I realize I'm asking something very difficult here as it requires an incestuous knowledge between the layers. Setting a flag that memory-mapped IO to a given open file has occurred is good enough, similar to how O_DIRECT writes might be handled. (triggering a later re-scan). 4) rename(), unlink() 5) mkdir(), rmdir() 6) truncate(), ftruncate()
If there are competing technologies to trap these kinds of operations, I am most interested in those that will last the longest (the most stability and community support), and those that are least filesystem-specific (the reiser4 plugins were exciting but don't seem politically viable).
Although my list 1-6 are simply examples, ideas as to what I've forgotten are helpful. But I'm not trying to be comprehensive, just communicate my design goal.
For example, passing this data to userspace would allow keeping a live locate/updatedb index. It would allow a database to track a per-block and per-file MD5. The availability of this data could facilitate snapshotting.