Re: [Dazuko-devel] Fwd: Mounting DauzkoFS on root

[John Ogness]

jim burns wrote:
> Is this possible? I can mount it on any subdirectory, and run 
> dazuko-3.0.0-birthday/build/user/example/c/example ( or example_mt ), and get 
> events reported on the console, but not if I overlay the root filesystem. 
> Also, my cpu usage doesn't go up, which further confirms dazuko is not 
> passing anything to antivir.

Yes, this is a known issue. The technical problems associated with this
are briefly mentioned in the README under the section:

"IMPORTANT - ALREADY RUNNING PROCESSES"

Since the "init" process is started before DazukoFS is mounted and all
subprocesses fork from "init", it is not possible to mount DazukoFS on
"/" and expect file events to be detected. For this to happen, the
DazukoFS mount would need to take place before "init" runs (which hasn't
quite been worked out yet).

I've been doing some experiments to see if I can use chroot(8) or
pivot_root(8) to try and accomplish this, but have been unsuccessful so far.


> Obviously, I could overlay every subdirectory of root, but if some process 
> manages to get a file into '/', it won't be scanned.

For the moment, that is the only available option.


> Oh, and I should say, when I try to mount DazukoFS, it doesn't echo 
> to /etc/mtab - only to /proc/mounts (openSuSE 10.2).

I will look into this. DazukoFS is based on the FiST project, so perhaps
they know more about this.

John Ogness

-- 
Dazuko Maintainer