Matching close() system calls

[Kerem Aksu]

Hello,

I am trying to trace files by using this rule :
"-a always,exit -F arch=b64 -S read,write,open,close -k file_op"

I can trace open() system calls with the "type=path" log occurred with the
same ID as the open() system call. I can learn which file is opened by that
open() system call.

But when it comes to other system calls I am unable to learn which file is
read, wrote or closed.

I tried to match arguments passed to system calls (a[0..3]) but those are
different than the arguments defined in linux man pages. I might
misunderstand these arguments.

How can I match these or any other (file) system calls with the files that
they used onto.
And when does a "type=PATH" log occurs?

Thanks.

[Steve Grubb]

On Wed, 14 Mar 2018 15:51:44 +0300

Post by Kerem Aksu
Hello,
"-a always,exit -F arch=b64 -S read,write,open,close -k file_op"
I can trace open() system calls with the "type=path" log occurred
with the same ID as the open() system call. I can learn which file is
opened by that open() system call.

If open returns a non-negative number, then that is the descriptor.
You'll need to match that descriptor as an argument to the other
syscalls for the same pid. You might need to watch exit_group also since
a program exiting closes all descriptors. And also you'll need to check
flags set by open and fcntl to see if CLOEXEC is being set.

Post by Kerem Aksu
But when it comes to other system calls I am unable to learn which
file is read, wrote or closed.

This is implicit by referencing the descriptor.

Post by Kerem Aksu
I tried to match arguments passed to system calls (a[0..3]) but those
are different than the arguments defined in linux man pages. I might
misunderstand these arguments.

No, they are pretty much the same.

Post by Kerem Aksu
How can I match these or any other (file) system calls with the files
that they used onto.
And when does a "type=PATH" log occurs?

You'll probably need to write a program using auparse to save the
descriptor from an open or openat and then output the information you
need as a custom program.

-Steve