Discussion:
Matching close() system calls
(too old to reply)
Kerem Aksu
2018-03-14 12:51:44 UTC
Permalink
Hello,

I am trying to trace files by using this rule :
"-a always,exit -F arch=b64 -S read,write,open,close -k file_op"

I can trace open() system calls with the "type=path" log occurred with the
same ID as the open() system call. I can learn which file is opened by that
open() system call.

But when it comes to other system calls I am unable to learn which file is
read, wrote or closed.

I tried to match arguments passed to system calls (a[0..3]) but those are
different than the arguments defined in linux man pages. I might
misunderstand these arguments.

How can I match these or any other (file) system calls with the files that
they used onto.
And when does a "type=PATH" log occurs?

Thanks.
Steve Grubb
2018-03-15 17:34:10 UTC
Permalink
On Wed, 14 Mar 2018 15:51:44 +0300
Post by Kerem Aksu
Hello,
"-a always,exit -F arch=b64 -S read,write,open,close -k file_op"
I can trace open() system calls with the "type=path" log occurred
with the same ID as the open() system call. I can learn which file is
opened by that open() system call.
If open returns a non-negative number, then that is the descriptor.
You'll need to match that descriptor as an argument to the other
syscalls for the same pid. You might need to watch exit_group also since
a program exiting closes all descriptors. And also you'll need to check
flags set by open and fcntl to see if CLOEXEC is being set.
Post by Kerem Aksu
But when it comes to other system calls I am unable to learn which
file is read, wrote or closed.
This is implicit by referencing the descriptor.
Post by Kerem Aksu
I tried to match arguments passed to system calls (a[0..3]) but those
are different than the arguments defined in linux man pages. I might
misunderstand these arguments.
No, they are pretty much the same.
Post by Kerem Aksu
How can I match these or any other (file) system calls with the files
that they used onto.
And when does a "type=PATH" log occurs?
You'll probably need to write a program using auparse to save the
descriptor from an open or openat and then output the information you
need as a custom program.

-Steve

Loading...