What needs to be modified in a Linux system so that the modification / access time to the file is replaced each time with a random one, instead of the real one?

R

Rozello2021-02-24 09:24:28

linux

Rozello, 2021-02-24 09:24:28

There is a deb-based Linux system.
I would like to achieve such a system behavior in which if the user created / read / changed / launched, etc. file, then a random value will be written as a timestamp in the file system, which is not related to the real time of the system.
What needs to be changed in the system to achieve this behavior?

Reply

Answer the question

In order to leave comments, you need to log in

7 answer(s)

J

jcmvbkbc, 2021-02-24
@Rozello

What needs to be changed in the system to achieve this behavior?

The easiest way is to change this function in the kernel.

P

pfg21, 2021-02-24
@pfg21

it's easier to write a script that will run through the user's files once an hour and change the times to random ones. :)
tell me immediately and directly from whom you want to hide and they will answer you correctly :)
and not these games of mom's coolhacker ...

V

Vladimir Korotenko, 2021-02-24
@firedragon

Order a rootkit in theory, this is its functionality.
But why is it so strange?

R

rPman, 2021-02-24
@rPman

Change libc, or immediately the kernel. A slightly simpler file system driver, the easiest way is to file the fuse layer, this is a custom file system driver in the user space.

C

CityCat4, 2021-02-24
@CityCat4

You need to change the calls that update the time stamp, of course. That is, a bucket (libc is useless to change, there are only wrappers). The replacement itself is algorithmically simple as a piece of wood - in the case when you need to update the timestamp - just generate a random number.
But :)
Since the numbers will be random, the dates will be monstrously ridiculous and any monitoring of any server will immediately scream.

M

mayton2019, 2021-02-25
@mayton2019

What kind of teacher thinks up such tasks? Really could not squeeze out something useful? Probably you need to change the OS kernel. Basically recompile. The task of KMK is non-trivial for some kind of lab. Here - rather, you can get a bunch of new side effects without even reaching the decision of the laba. In general, it is easier to bring money to the department.

S

Saboteur, 2021-02-24
@saboteur_kiev

You can simply teach the user how to use a text editor like vi / vim
and make a wrapper script that, after closing vi / vim, will change the file date to an arbitrary