What kind of Mac driver should I need to build in order to intercept the file system?

In the Windows world I can create a file system filter (upper or lower) in order to hook my driver to action when a file is changed (for example auditing or creating virtual drives).

Do you know which is the similar model in a Mac? the I/O Kit talks about driver development but does not specify the storage model or file system. Is there another kit?

2009-06-16 13:57
by No hay Problema

Looks like there is a private API that spotlight uses, some source available here:

http://osxbook.com/software/fslogger/

If you want to create your own filesystem (like what a virtual drive would be), use MacFuse

http://code.google.com/p/macfuse/

2009-06-16 14:02
by Lou Franco

Thanks, i will look on the first link as I need to do something similar, just a bit more complex. But having some source is a good starting point. Thank - No hay Problema 2009-06-16 14:14

Didn't OS X have kevent/kqueue like FreeBSD?

2009-06-16 14:15
by Marco van de Voort

This actually gave me the lead, yes, there are kqueues and kevents as stated here: http://developer.apple.com/documentation/Darwin/Conceptual/FSEventsProgGuide/KernelQueues/KernelQueues.html#//appleref/doc/uid/TP40005289-CH5-SW2 . I am going to start here - No hay Problema 2009-06-16 14:55

Found this

http://developer.apple.com/documentation/Darwin/Conceptual/FSEvents_ProgGuide/Introduction/Introduction.html#//apple_ref/doc/uid/TP40005289-CH1-DontLinkElementID_15

2009-06-16 14:31
by grrr

Thanks, interesting area to investigate. Seems that in Mac world all these stuff is spread around user mode and kernel mode. : - No hay Problema 2009-06-16 14:57