Re: Matching close() system calls
On Wed, 14 Mar 2018 15:51:44 +0300
Kerem Aksu <ahmtkrmd96(a)gmail.com> wrote:
Hello,
I am trying to trace files by using this rule :
"-a always,exit -F arch=b64 -S read,write,open,close -k file_op"
I can trace open() system calls with the "type=path" log occurred
with the same ID as the open() system call. I can learn which file is
opened by that open() system call.
If open returns a non-negative number, then that is the descriptor.
You'll need to match that descriptor as an argument to the other
syscalls for the same pid. You might need to watch exit_group also since
a program exiting closes all descriptors. And also you'll need to check
flags set by open and fcntl to see if CLOEXEC is being set.
But when it comes to other system calls I am unable to learn which
file is read, wrote or closed.
This is implicit by referencing the descriptor.
I tried to match arguments passed to system calls (a[0..3]) but
those
are different than the arguments defined in linux man pages. I might
misunderstand these arguments.
No, they are pretty much the same.
How can I match these or any other (file) system calls with the
files
that they used onto.
And when does a "type=PATH" log occurs?
You'll probably need to write a program using auparse to save the
descriptor from an open or openat and then output the information you
need as a custom program.
-Steve