Calling a program when inode is unlinked

Ignoramus17480

Was afraid that was what you meant, but tried to slide by on-the-cheap.

But what if the filesystem were encrypted, not just the file? And what about temp files that did not, in fact, get cleaned up at all?

You mean this one:

In any case, something like that would be necessary -- ie., patching the kernel and having all the fun of maintaining it and installing it everywhere needed.

The only other way I can think of would be to write a kernel module that intercepts the system call(s) that deletes a file and subsbreastutes a "secure" delete-shred function in its place. Sounds good, no? I haven't a clue where to begin searching the source code :-(

I do have some example code around somewhere that shows how to write such a module, but it's late and I'm too lazy-tired to hunt it down now. If you're interested, I can locate it tomorrow.

But ... You can get carried away with this sort of thing. Filesystem encryption seems more "mainstream" and even that leaves some people worried about leftover data on swap. After all, a burglar is more likely to find "goodies" in existing files than to take the time recovering deleted files that may or more likely will not be useful. If the FS is encrypted, a deleted file is no more revealing than an existing one -- nay, even less so ;-)

till we meet again, prg