kqueue implementation

[Joerg Sonnenberger]

On Tue, May 22, 2007 at 10:04:37AM -0700, Suleiman Souhlal wrote:
> >I mean vnode events, in the manual page I see NOTE_WRITE, but I
> >need NOTE_OPEN and NOTE_READ. Is there any chance to get these
> >kind of events?
> 
> They should be easy to add.. All you would need to do for NOTE_OPEN  
> would be to add a vop_open_post  hook to VOP_OPEN that calls  
> VFS_KNOTE_LOCKED(..., NOTE_OPEN). Similarly for read.

If this is done, it should be done very carefully. There are some
non-trivial security implications by this, for example the process
hiding can be at least partly circumvented by adding a open filter on
rtld or libc.so.

Joerg