This sounds like an LSM, possibly with a component which communicates with userspace, depending on how sophisticated "verify" needs to be.
Yes, the component *should* communicate with the userspace. The sophistication of "verify" varies from user to user. The tool will provide a few procedures to, say, verify integrity and log call. But "verify" was a plain example, where my point was that the user could extend/add these procedures for their own needs. VisorFlow sounds interesting. I've seen the paper is on submission. When will it be published? On 06/28/2017 09:49 PM, W. Michael Petullo wrote:
Whenever fopen("/etc/shadow", "r") is called, the tool would intercept it, run the verify() procedure, and return back to the syscall, allowing it to do it's job.
This sounds like an LSM, possibly with a component which communicates with userspace, depending on how sophisticated "verify" needs to be.
We've also done some very early work in trying to do this type of thing from a hypervisor. See:
-- - seds ~> https://seds.nl