Can we do perform a C style file Read/Write from within a ARP module

[perryh at pluto.rain.com]

Eugene Grosbein <egrosbein at rdtc.ru> wrote:

> 27.12.2011 20:11, perryh at pluto.rain.com ?????:
> > Jason Hellenthal <jhell at DataIX.net> wrote:
> >>
> >> See siftr(4). This module writes to a file.
> > 
> > Is siftr(4) new since 8.1?
>
> HISTORY
>      SIFTR first appeared in FreeBSD 7.4 and FreeBSD 8.2.

which explains why there's no manpage for it in 8.1 :)

It turns out that siftr(4) does not directly manipulate its
logfiles, instead using alq(9) which has been around since 5.0.

To (partly) answer the original question, it looks as if alq(9)
can handle opening/creating and writing to the file -- and siftr(4)
will serve as an example of using alq(9) -- but on a brief perusal
it does not look as if alq(9) includes a mechanism to read back the
data.

One kernel operation that does directly process data from files --
as opposed to passing the data to a userland process for processing
-- is execve(2), which must examine the file header to identify the
type of executable being invoked.