4 ms·
I haven't come across of any project like that, but in case anyone wants to implement this and doesn't know where to start, here's a way to do it on a freedeskt
by epilys 4y ago
I haven't come across of any project like that, but in case anyone wants to implement this and doesn't know where to start, here's a way to do it on a freedesktop-compatible linux:
Make a userspace daemon process that adds eBPF tracepoints[0] to open{,_at} etc syscalls which match files of your user directories with specific extensions (e.g. .docx).
Associate PIDs that open those files with their .desktop entries[1]
Store results in some database like sqlite3.[2]
Search this database with your favorite interface, like a CLI script or a GNOME shell search provider[3].
I have seen this Rust project on HN which does something similar but with file attribute syscalls, you can use it as reference: https://github.com/javierhonduco/sweeper https://github.com/javierhonduco/sweeper
[0]: https://github.com/iovisor/bpftrace https://github.com/iovisor/bpftrace
[1]: https://www.freedesktop.org/wiki/Specifications/desktop-entry-spec/ https://www.freedesktop.org/wiki/Specifications/desktop-entr...
[2]: https://sqlite.org/ https://sqlite.org/
[3]: https://developer.gnome.org/documentation/tutorials/search-provider.html https://developer.gnome.org/documentation/tutorials/search-p...
- DontchaKnowit 4y agoThis is wonderful, thank you. I may try this out. Originally wanted to do it for windows but I eventually concluded it would take some prodigious hackery to get it do work
- epilys 4y agoI wish I could help you but I haven't touched windows in decades. Perhaps someone else can chime in.
- DontchaKnowit 4y agoSo as far as I can tell the only way a user can access this type of info on windows is via procmon. Problem is its just a gui application, no programatic access afaik. I did find a project where someone reverse engineered it to some extent and it allowed you to make calls to it programatically. Anyway, it turned out there was a loooot of heavy lifting that'd be required to get it to behave the way I needed it. Anywho, I'm happy for the info on linux. I was looking for a project that would require me to up my bash skills anyway. This sounds perfect
- Joker_vD 3y agoI'm pretty sure the latter (Win8 and on?) versions of Windows had some sort of framework for writing FS filter drivers or something, that the AVs are supposed to use?
- p_l 3y agoEvery NT version, in fact. Driver filters including filesystem filters are core NT feature. So you'd have to write a driver that hooked itself at appropriate step in IO Request processing, then it could inspect and gather data just like eBPF. Procmon uses diagnostic interfaces from outside kernel, might require debug permissions.