File System Based On Linux Kernel Drivers Monitor

With the development of computer technology and extensive application,the computer security requirements are increasingly higher and higher. A major problem is to ensure that the security of the data in the disk,and can real-time to find the abnormal operating conditions,and thus timely and systematic improvements and manitenance,which requires real-time analysis the kinds of information and data during file operations generated .But the current linux platform,and there is no good tool to monitor file operations,and therefore to design a file system base on linux platform monitoring system become important.The fie system monitoring protect the disk data security,a prowerful way by the file system on top of additional layer of file system filter operations,the system can be achieved to prevent unauthorized access the key files was the purpose of the process,and provides the log information for analysis for the system security,which has importand theoretical and practical significance..This work describes the significance of the subject topics of the development of the status quo at home and aboard,and put forward a new methods of monitoring the file system which is designed and implemented base on linux kernel system driver monitoring system.This monitoring system in the linux kernel is equivalent to a file system filter,located at VFS and lower specific file systems.It monitors all file operations,according to the user to provide monitoring informations to filter which need the process infomations which to be monitored and key files list.once the filtering operations is complete,operational processes will be forwarded to the lower file system operation to complete.This monitoring system design is divided into a user monitoring module,MFS(Monitor FileSystem)module and communication module,User module in user space to provide monitoring of the process list and a list of key files and provide configuration functionality,and display the log information after filter operations.MFS module is the core module which is a linux kernel loadable module,dynamic loading between the VFS and underlying file system.,according the monitoring information to filter all file operations;communication module provides the MFS module and the user module data communication,the module pecified by the user process and the key files information passed to the MFS module and the module will get log information which MFS module feedback to the user monitoring module.This detailed description of each module in the design and implementation.