Slashdot Mirror
Watching Under The Hood Of Tiger's Spotlight
jaketheitguy writes "Over at KernelThread.com, Amit Singh has released a commandline app called FSLogger for looking under the hood of Tiger's Spotlight. You can watch all kinds of filesystem changes going on in realtime. The utility apparently intercepts and displays filesystem change data as it goes out to Spotlight from the kernel. It even tells you which app is making the changes. Looks like Apple has included some pretty powerful API's in Tiger and there may be some othre really interesting uses of this API as mentioned on the app's page. I for one would really like to be able to tell if somebody changed ANY files on my system without my knowledge. I think you can do that with Singh's program, but how do you make sure somebody cannot disable the program?"
Although it's two different areas, isn't two articles on spotlight a little extreme? :-)
Come on Hemos, lets have a hattrick
and oh... I for one welcome our new Spotlight overlords
This is my sig. There are many like it but this one is mine. My sig is my best friend. It is my life.
So all the article says is that the Silver Bullet or Holy Grail of Searching didn't turn out to be something one could create simply by telling the programmers to do it?
Apple (and MS for that matter) try to create a system where you don't have to keep any order on your computer and find anything you want instantly. I am sure I am not the only one with a gut-feeling that this is closer to the area of unsolvable problems, right with "Making Software Idiotproof" and "Creating the perfect user-interface everyone can use without any prior computer experience" and "Creating a 100% secure computer on the internet",...
[ Reply to This | ]
I used to be a lonely nerd, but thanks to Spotlight I can:
- Run Faster
- Jump Higher
- Score with the chicks
- Regrow lost hair!
Conformity is the jailer of freedom and enemy of growth. -JFK
It seems that the Spotlight is in the spotlight. Contrary to what I said before, the AC might have been right about Spotlight being overhyped in the extremes. It is overhyped to the max.
Karma: Positive (probably because of superiour intellect)
So, this application would shine a spotlight on Spotlight? Is that anything like when you point a video camera at a monitor hooked up to the camera's output?
... and then they built the supercollider.
You could control changes to the app itself by having 2 editions of an fslogger based tripwire-app running together and then have the one go off when some changes happens to the other and vice versa.
First there always has been a program called /usr/bin/fs_usage which monitors file system access. Second is the story writer worried about someone altering his files or about spotlight. How spotlight functions has been the subject of many detailed articles. Any time you change a file, spotlight calls the appropriate indexing program and collects and stores the metadata. It is not going to alter the data fork of your document but the data has to get stored somewhere. So relax.
this story is paranoid delusional.
This has a lot of potential in the server market. Imagine an IDS that monitors certain files for changes and notifies the sysadmin immediately whenever a static file is updated. The system could have scheduled periods for upgrades, during which it doesn't send a thousand warnings to you, but other than that, it could monitor all disk activity at a low level without being subverted by e.g. changing the IDS's file hashes before it does its next check.
Interesting idea.
... when you need him?
... as if a million of his posts were made, and then suddenly silenced. Hmm...
He was very vocal about this sort of thing, and now he's gone very quiet. Almost as if he was an Apple employee who was given The Warning (tm) or... (obligatory Star Wars reference being used in shameless Karma whoring)
When I get some time, I'll read the article (thus breaking a long-running streak for me) and compare to ASoT's statements.
Actually you can get this functionality already in a long standing Unix utility called Tripwire.
http://www.tripwire.com/
http://sourceforge.net/projects/tripwire/
There is even a Mac OS X version now it seems:
http://www.macguru.net/~frodo/Tripwire-osx.html
Of course you'd probably then want an OS that implements some form of relevant Mandatory Access Control / POSIX.1e (e.g. LIDS for Linux, Trusted Solaris, or Argus Pitbull (Linux/Solaris)) to help prevent the intruder from interfering with Tripwire itself.
Take a look at the kqueue(2) man page.
There are more details available at http://people.freebsd.org/~jlemon/papers/kqueue.pd f
"how do you make sure somebody cannot disable the program?"
You can't, not withint guarenteeing physical security to the box.
If someone can pull your hard disk OR boot with their own media, all is lost.
Short of that, your question amounts to "how do I keep from getting rootkitted."
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
You may be shocked to know how often files change on your system... without a good policy defining the scope of your monitoring, you're asking for a world of hurt. As @madeus mentions, there is an OS X build of Tripwire which gives you a good deal of this functionality. Two caveats, however:
- Tripwire is not a real-time service, it's scheduled to run at specific (user-defined) times.
- Tripwire does not prevent anyone from making changes - it merely ensures that any changes to the OS are recorded and made visible to you.
That said, Tripwire is a very functional tool with excellent scripting and integration potential. Plus, it has a good amount of internal security - unless you know the relevant passphrases, you cannot subvert the product. If you root the box you can always uninstall it, but you can't tamper with the database or policy to hide your changes or trick Tripwire into sending a false 'all clear' message.
As with all such tools, it's best to check it out and evaluate it for yourself to see how it works for you.
An object at rest cannot be stopped!
Here are three reasons why:
1. ASOT is too familiar with the technical underpinnings of Apple technology. Steve Jobs is smart smart smart, a great businessman, but there is no way he is this familiar with all the technical details. That was what Woz was for, remember? (No I'm not implying this is Woz, since he clearly no longer has this much access to Apple.)
2. There's no way the CEO of a public company would risk the MAJOR, MAJOR, MAJOR lawsuits and trouble that could be caused from the SEC and shareholders by divulging valuable information on Slashdot. There are rules the company officers must strictly follow in regards to how they divulge information previously unknown to the public. The information must reasonably be made publically available, not posted anonymously on Slashdot.
3. Steve Jobs gets more bang for his buck by keeping things top secret until the next time he's doing a keynote.
Ironically, the word ironically is often used incorrectly.
Seems like fs_usage does the same thing, and is already installed with OS X. From the man page:
...] [pid|cmd [pid|cmd] ...]
NAME
fs_usage -- report system calls and page faults related to filesystem
activity in real-time
SYNOPSIS
fs_usage [-e] [-w] [-f mode [-f mode]
DESCRIPTION
The fs_usage utility presents an ongoing display of system call usage
information pertaining to filesystem activity. It requires root privi-
leges due to the kernel tracing facility it uses to operate. By default
the activity monitored includes all system processes except the running
fs_usage process, Terminal, telnetd, sshd, rlogind, tcsh, csh and sh.
These defaults can be overridden such that output is limited to include
or exclude a list of processes specified by the user.