I am developing a file encryption and decryption software on Mac. The main function of this software is to set up a special folder, and all files in this folder will be automatically decrypted when opened. After the files are copied out of this folder, the files need to remain encrypted. I achieve such a folder by mounting a MacFUSE-based file system.
But after I copied the file out of the special folder, I found that the copied content was plain text. I think this may be caused by the cache of the Mac system. In order to prevent the decrypted content from being copied, I wanted to hook the vnode write operation and replace the copied decrypted content with the encrypted content.
I borrowed the method from this link
MacOSX-FileSystem-Filter to hook the read and write operations of vnode. The core idea of this hook method is,
// assumtion is - the vnode layout is as follows
// <some fields that are irrelevant for us>
// int (**v_op)(void *); /* vnode operations vector */
// mount_t v_mount; /* ptr to vfs we are in */
// void * v_data; /* private data for fs */
So after I got the vnode object from Kauth, then do some pointer movement to replace the vnode operations vector int (**v_op)(void *); , thus I can hook the vnode operations.
