Modify UNLINK system call so that it is a WIPE and then UNLINK?

[s1sw]

Hello all!

Closed source applications used on our server use the unlink system call to delete files.

My goal is to make it so unlink system call actually shreds/wipes the file a set number of times before it returns area to the filesystem.

How would you approach this task?

Thanks for your suggestions!

s1sw

PS I think this is security and also an OS question, I'll start a thread linking to this one in other areas of the forum hoping this is not against any rule, so any input by other users would remain in one thread.

[nasekomoe]

Hello!
I actually don't understand what particularly is this question about. If you try to figure out how to replace a system function for a while, there is enough info in the net how to do this. Look for subjects like linux kernel development, system calls replacements, kernel module programming or something like that.
In a nutshell, you should write a kernel module in which you replace "unlink" call with your own. Inside your call you do whatever you want and after that you call a standard "unlink" system call.
Sorry if i haven't caught what it's all about here...

[oz]

I'll start a thread linking to this one in other areas of the forum hoping this is not against any rule

Hello and welcome to the forums!

Sorry, but redirects and duplicates are not allowed, so those that you've posted have been deleted:

http://www.linuxforums.org/forum/lin...ums-rules.html

[Lakshmipathi]

Hello!
In a nutshell, you should write a kernel module in which you replace "unlink" call with your own. Inside your call you do whatever you want and after that you call a standard "unlink" system call.

Agree. If you can't modify the source code of your application (writing some random data on file and then sync & delete) Only other option is to add kernel module to intercept/modify unlink () call to wipe out data addresses. But the drawback would be this module needs to be available/loaded at all machines where you want to run the application.

And also this going to tricky, It also depends on what kind of File system you are using? If you are using ext3 on one machine and ext4 on another - then probably you have to write two modules and load them at appropriate place.

[popandopolo]

You can set a wrapper using LD_PRELOAD, too.