Linux Driver Develop C

File integrity check daemon
Create system drivers for instrumenting file system operations in Linux environments, below are the two possible methods for creating potential solutions. Driver should take parameters from config.ini
Parameters
1. Exclude_paths – paths single line comma separated array, so that driver will not interfere hooking
2. max_file (l1) – file size more the this will be excluded from hashing
3. enable_hash – (boolean)hashing capabilities
4. syslogging – (boolean)log output to syslog capabilities
Approach
1. Master file table – understand file distribution in file table and instrument access and monitor changes performed by system
a. Example for windows - https://www.researchgate.net/figure/MFT-layout-structure_fig2_282148007
2. Write file system call hooking or instrumenting
a. In Windows Microsoft Detour library can be used for similar results
Objective is to get below variables for each write operations
• Event time
• Process attempted path
• Target File path modified
• Magic byte of the target file
• File changes entropy (partial or fully modified, yes or no value)
• Size of target file
• Hash of the target file (L1= if more than 100KB)
• % Content modified portion in the file (for files more than L1)