Kauth event for write operation

[simran charley]

Hi,

I want to know which event we get when we write data in the file.I want to catch each write operation.

I have registered for Vnode and File scope.I get event KAUTH_VNODE_WRITE_DATAwhen I open the file in write mode, then no events for write data (writing using write() api or using Texteditor) and KAUTH_FILEOP_CLOSE with dirty flag  "true" when I closed the file or save the contents of file.

Please explain the mechanism of Kauth in this case.

Thanks,

Simran.

[Quinn "The Eskimo!"]

On 24 Mar 2012, at 07:43, simran charley wrote:

> I want to catch each write operation.

There's really no supported way to do this in Mac OS X. KAUTH_VNODE_WRITE_DATA authorisation is done when the file is opened and KAUTH_FILEOP_CLOSE notification is done when the file is closed but, for performance reasons, there's no supported way to be authorise or be notified of every single write operation.

Share and Enjoy
--
Quinn "The Eskimo!" <http://www.apple.com/developer/>
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

_______________________________________________
Do not post admin requests to the list. They will be ignored.
Darwin-kernel mailing list (Darwin...@lists.apple.com)
Help/Unsubscribe/Update your Subscription:
https://lists.apple.com/mailman/options/darwin-kernel/darwin-kernel-garchive-95844%40googlegroups.com

This email sent to darwin-kernel-...@googlegroups.com

[simran charley]

Hi,

Thanks for reply. It is helpful for me.  

I want to ask one question regarding copy operation.

I am doing copy operation from one location to other.

I have get  following events:

if i have copy file1.rtf to file2.rtf, 

following events I get on file2.rtf

scope=com.apple.kauth.fileop, action= {KAUTH_FILEOP_OPEN } path=/private/var/root/Desktop/test/file2.rtf

scope=com.apple.kauth.vnode, action=  {WRITE_DATA ACCESS } path=/private/var/root/Desktop/test/file2.rtf 

scope=com.apple.kauth.fileop, action= {KAUTH_FILEOP_CLOSE} path=/private/var/root/Desktop/test/file2.rtf, dirty=true

scope=com.apple.kauth.vnode, action= {WRITE_DATA ACCESS } path=/private/var/root/Desktop/test/file2.rtf 

 

Here after file closed with dirty = true, means file modification done, then what is the significance of  last  event {WRITE_DATA ACCESS} ? 

Thanks,

Simran.

> I want to catch each write operation.

There's really no supported way to do this in Mac OS X. KAUTH_VNODE_WRITE_DATA authorisation is done when the file is opened and KAUTH_FILEOP_CLOSE notification is done when the file is closed but, for performance reasons, there's no supported way to be authorise or be notified of every single write operation.

Hi,