Is there something like a filter filter for Mac OS X?

Question

Windows allows you to develop a filter driver for detecting file I / O in VFS. But I can not find something similar for Mac. It has something called Filter Schemes, but it is for HFS +. Does anyone know if there is a way to intercept file I / O on a Mac without using programs like MacFUSE?

Answer 1

I found out that Mac OS X does not allow filter drivers at all.

“The file stacking system (sometimes called the filter file system) sits on top of another file system and somehow changes its behavior. A canonical example of the stack file system is the encryption file system. You can put this file system on top of any existing file system for provide encryption support. Apple does not support the development of stacking VFS plug-ins on Mac OS X "( http://developer.apple.com/mac/library/qa/qa2001/qa1242.html )

Answer 2

kauth (introduced in OS X 10.4) is the closest to FS filter drivers.

Here is a good review of the various APIs present in Mac OS X. This should be a good starting point. http://osxbook.com/blog/2008/07/23/extending-hfsdebug/

Answer 3

I am not at all familiar with the Windows technologies that you mentioned, but it looks like you can look for FSEvents.

http://developer.apple.com/mac/library/documentation/Darwin/Conceptual/FSEvents_ProgGuide/Introduction/Introduction.html

The file system event API provides your application to request notification when the contents of a directory hierarchy. For example, your application can use this to quickly detect when a user modifies a file within a project using another application.

It also provides an easy way to determine if the directory hierarchy has changed since your application last studied them. For example, a backup application can use this to determine which files have changed since a given time or a given event identifier.

You should read this document if the application works with a large number of files, especially if your application works with large file hierarchies.