一句话：在虚拟机层拦截块设备请求并按文件系统结构解析，实现与客户操作系统无关的文件操作追踪。
现有文件操作追踪方法通常与特定操作系统绑定，导致难以在特殊或定制操作系统中监控文件行为，也难以追踪以特权模式运行的程序。本文提出一种文件系统层面的解决方案：在虚拟机监视器层拦截虚拟机对块设备的读写请求，再按目标文件系统的磁盘布局解析这些请求，从而重建文件级操作，因此对客户操作系统透明且与 guest OS 无关。作者基于 QEMU 模拟器实现了原型，并支持 ext2 与 ext3 文件系统。该方法使得在同一机制下监控任意客户 OS 的文件操作成为可能，为缺乏通用追踪接口的环境提供了可行途径。
Existing file operation tracing methods are always OS-specific. It is a problem for file monitoring in some exotic operating systems and other programs running in privileged mode. We present a file system specific solution that could be work with any guest OS on a virtual machine. This solution works on the basis of intercepting requests to a block device. Our implementation is based on the QEMU emulator and supports ext2 and ext3 file systems.
DOI 原文 ·
@inproceedings{paperbot5160,
title = {File tracing by intercepting disk requests},
author = {Vladislav Stepanov},
booktitle = {FSE},
year = {2019},
doi = {10.1145/3338906.3342485}
}