Linux Inode Structure

[siddheshbade]

Hi,
I am doing a project that deals with linux file system. My question is whether we are allowed to edit the inode structure or not i.e. to add an additional attribute that could keep track of user who accessed the file????

[Lakshmipathi]

You are not allowed to edit inode structure unless you get "green signal" from File system developers But what you can do is, try to use some reserved but unused bits in inode use it (this means messing up FS too) as long as it remains reserved bit - you program will work.

Else take better approach something like create your own list/buffer that keep track of users.

[siddheshbade]

Thank U Lakshmipathi for your suggestion
I would just like to cofirm that were you refering to a log kind of thing that would keep the track of users or something different. My point of view is that log will contain the file name with the users who modified and when.

[Rubberman]

As you can imagine, there are any number of ways to do this. If you want to do it in the file system driver itself, then I suggest you use fuse and create your own. It can be a mofification of the ext2/ext3 file system with your changes to the inode structures or whatever else is appropriate for your needs, such as tracing all write access to the files in question. Other methods apart from rolling your own file system driver could be to have a loadable kernel module that intercepts and traces write access to the files in question. I'm sure there are other methods that will work for you. So, at issue here is are you more interested in a specific approach, or solving the more general problem of knowing who did what and when?

[siddheshbade]

Thanks rubberman for the suggestions.
As far as my priority i am more concerned about tracking the user who did what and when rather than approach. So what u suggest what path would be better to choose?

[Rubberman]

Personally, I'd opt for the intercept open and write events technique and log the appropriate information to a secure file. That would make it a reasonable proposition so install in any desired system. You can even make it dkms-compliant so that it will automatically get reinstalled even if the kernel is updated.