Re: Safety copy app based on Dazuko?

piotr.wanat <at> interia.pl wrote:
>     I hope writing directly to you not on dazuko forum is
> not violating of your privacy ;)

Hi,

I hope replying on the dazuko-devel mailing list isn't violating yours. ;)

> I'm asking for your help with certain application I'm
> attempting to incorporate in the development environment.
> My goal is to intercept system calls concerning operations
> on files in assumed path and create backup copies of those
> files. I'm using 2.6.11-rsbac-r2-rsbac kernel with dazuko
> 2.0.6. So far I bumped into two major problems:
> 
> - dazuko won't report ON_CLOSE_MODIFIED even but I am
> familiar with this issue. My question is - what would
> you recommend in this case? Is there any advantage of 
> moving to another version of Dazuko or kernel/OS?

Because of how Dazuko currently hooks into the kernel, ON_CLOSE_MODIFIED is 
too unreliable. My recommendation would be to implement this test yourself 
in userspace (for example, using the stat(2) function). This event may 
return for the 2.2.x version of Dazuko.

> - I'm also getting no reports on "mv" operations. As far
> as I'm concerned this is based on link/unlink operations,
> which I guess should be reported by current version of
> Dazuko module (at least I'm getting correct reports on
> unlink) ?