kernel space realpath()

kernel space realpath()

[Ramy M. Hassan]

Hi,
I am new to kernel development. I am developing now a kernel module to
create log of all file operations under a certain specified directory. I
intercept the system calls that may do modifications to this directory
contents and create the logfile. My problem is that a system call like
sys_unlink takes a path that could be relative, and could contain ".." or
".". It might also contain components that are symlinks to other
directories. So I want to get the real path of that file given its relative
path name.
Is there anyway to do that ?

I appreciate your help.
Best regards

Ramy

Re: kernel space realpath()

[Matthew Wilcox]

On Sun, Mar 23, 2003 at 07:49:18PM +0200, Ramy M. Hassan wrote:
> I am new to kernel development. I am developing now a kernel module to
> create log of all file operations under a certain specified directory. I
> intercept the system calls that may do modifications to this directory
> contents and create the logfile. My problem is that a system call like
> sys_unlink takes a path that could be relative, and could contain ".." or
> ".". It might also contain components that are symlinks to other
> directories. So I want to get the real path of that file given its relative
> path name.
> Is there anyway to do that ?

Isn't this exactly what the LSM project does?  See http://lsm.immunix.org/

-- 
"It's not Hollywood.  War is real, war is primarily not about defeat or
victory, it is about death.  I've seen thousands and thousands of dead bodies.
Do you think I want to have an academic debate on this subject?" -- Robert Fisk

Re: kernel space realpath()

[Jan Hudec]

On Sun, Mar 23, 2003 at 07:49:18PM +0200, Ramy M. Hassan wrote:
> Hi,
> I am new to kernel development. I am developing now a kernel module to
> create log of all file operations under a certain specified directory. I
> intercept the system calls that may do modifications to this directory
> contents and create the logfile. My problem is that a system call like
> sys_unlink takes a path that could be relative, and could contain ".." or
> ".". It might also contain components that are symlinks to other
> directories. So I want to get the real path of that file given its relative
> path name.
> Is there anyway to do that ?

You should take a look at some syscall, that returns path. Like
sys_getcwd. It call d_path (resp. __d_path, because it already has all
the locks).

-------------------------------------------------------------------------------
						 Jan 'Bulb' Hudec <bulb@ucw.cz>

Re: kernel space realpath()

[Nir Tzachar]

> I am new to kernel development. I am developing now a kernel module to
> create log of all file operations under a certain specified directory. I

look at http://www.cs.columbia.edu/~ezk/research/fist/

you can achieve what you want, and even more.



-- 
========================================================================
nir.

Re: kernel space realpath()

[Chris Wright]

* Matthew Wilcox (willy@debian.org) wrote:
> On Sun, Mar 23, 2003 at 07:49:18PM +0200, Ramy M. Hassan wrote:
> > I am new to kernel development. I am developing now a kernel module to
> > create log of all file operations under a certain specified directory. I
> > intercept the system calls that may do modifications to this directory
> > contents and create the logfile. My problem is that a system call like
> > sys_unlink takes a path that could be relative, and could contain ".." or
> > ".". It might also contain components that are symlinks to other
> > directories. So I want to get the real path of that file given its relative
> > path name.
> > Is there anyway to do that ?
> 
> Isn't this exactly what the LSM project does?  See http://lsm.immunix.org/

Actually, LSM works with dentry/vfsmount pairs not raw pathnames, but
yes, there are filesystem level hooks that allow one to do things like
this.
-- 
Linux Security Modules     http://lsm.immunix.org     http://lsm.bkbits.net