在Linux中拦截磁盘写入

Question

I want to intercept every disk write operation in a Linux server. In detail, I want to catch every disk write operation right at the time when it happens and be able to work out which process initiated the call, where it is trying to write and so on. To make it simple, for now, I am concentrating on ext3 only. I am aware of auditfs and other 'watchers' which only will let you know once the operation has happened. As said earlier, I want to intercept as it happens and be able to retrieve all information about the operation (process information, target location, content being written). If there is an interrupt/call back kind of mechanism (for example receiving a notification of any write operation by a process, process group or session - pid, pgid, sid), it will be even better.

Thanks

Answer 1

I did some searching on this very issue, and these look promising: • Copyhook Handlers - for MSDOS Shell, lodge an interception DLL in WinReg • NtSetInformationFile • Minifilters - I think these are portable for cross-platform • Installable File system drivers - well, of course

File Share type: some filesystems support audit and protection hardening, but may be only "After-The-Fact".

CopyHook looks promisingly simple: Intercepting shell file manipulation calls in windows:

https://msdn.microsoft.com/en-us/library/bb776048.aspx

The driver-level stuff gets very hairy, very quickly ...