According to Bill Studenmund:
>
>One thing you might try is making it a layered file system.

Mmmmm that is a good thought.  I will put up what I have done since I
know that it works and have a look at doing a layered fs.  It
certainly makes a lot of sense.

>
>The advantage of using a file system is that you have to hack into a lot
>fewer code points - the kernel already asks the FS if it can execute a
>file. :-)
>

Yes, this is very true.  At the moment the code hits very few of the
kernel files (most of the guff is actually to implement a
pseudo-device for loading the signatures) but if I want to intercept
the open and mmap calls then doing all the checks at the file system
layer sounds like a better approach.

-- 
===============================================================================
Brett Lymn, Computer Systems Administrator, BAE SYSTEMS
===============================================================================