我怎样才能得到一个文件正在读取OS X的通知？ [英] How can I get notifications that a file is being read on OS X?

问题描述

我有一个在Windows上工作的软件。该软件有两个组件：在内核模式下工作的文件系统微过滤器驱动程序和与驱动程序通信的用户模式组件。驱动程序接收有关IO中断请求的通知，例如 IRP_MJ_READ 。这样做的示例应用程序可以在 github <一>。这适用于Windows支持的任何用户和大多数文件系统。

我需要为OS X开发类似的软件（仅适用于桌面和服务器）。我看的东西：

• FSEvent
内核队列

• 系统调用表API挂钩/劫持


• kprobe


• fanotify li>
  

我的预订是：FSEvents可能不是非常高性能，因为我需要监视根 /



问题：如何获取通知：任何用户正在读取根 / 中的任何（递归）文件夹中的文件在OS X上？


解决方案

使用内核扩展，内核授权提供了，允许您监视。，允许您监视 KAUTH_FILEOP_OPEN 对所有vnodes执行操作。

$ b

在访问之前调用 KAUTH_FILEOP_OPEN 到所有文件，从而允许你监视文件访问。

如果你想要更多的粒度的行动， VNode范围提供了一组更大的操作，包括 KAUTH_VNODE_READ_DATA ，但是请注意，这个范围可能很嘈杂y，在任何时候触发大量的操作。

这样的内核扩展的代码示例可以在Singh的 Mac OS X内部设备

I have a piece of software that works on Windows. The software has two components: file system minifilter driver that works in kernel mode and a user mode component that talks to the driver. Driver receives notifications on IO interrupt requests, such as IRP_MJ_READ. A sample application that does this can be found on github. This works for any user and most file systems supported by Windows.

I need to develop similar piece of software for OS X (desktop and server only). Things I looked at:

• FSEvent
• Kernel Queues
• System call table API hooking/hijacking
• kprobe
• fanotify

My reservations are: FSEvents may not be very performant, as I need to monitor root / folder and any mounted devices. I have very limited understanding of kernel queues and syscalls API hijacking may make it very hard to port to different OS X versions and can cause conflicts with AV or OS protection (such as PaX hardening).

Question: how can I get notifications that a file in any (recursive) folder in root / is being read by any user on OS X?

解决方案

With a kernel extension, Kernel Authorization provides the File Operation Scope, allowing you to monitor the KAUTH_FILEOP_OPENaction for all vnodes.

The KAUTH_FILEOP_OPENaction will be called before access to all files, thus allowing you to monitor file access.

If you want more granularity of actions, the VNode scope provides a larger set of actions, including KAUTH_VNODE_READ_DATA, but be aware that this scope can be very noisy, triggering a very large number of actions at any one time.

Example code for such a kernel extension can be found in Singh's Mac OS X Internals

这篇关于我怎样才能得到一个文件正在读取OS X的通知？的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！