snoopfs.fist

Solaris操作系统下的过滤驱动程序, C源码程序.

%{

  /*
   * snoopfs: warn of possible illegal use by non-root non-owners
   */

%}
debug off;
%%
%op:lookup:postcall {
if ((fistLastErr() == EPERM ||
     fistLastErr() == ENOENT) &&
    $0.owner != %uid && %uid != 0)
  printk("snoopfs detected access by uid %d, pid %d, to file %s\n",
	 %uid, %pid, name);
}
%%
/* no extra routines are needed */

/*
 * Local variables:
 * c-basic-offset: 4
 * End:
 */