Thanks Nir, >> I want understand the flow of write operations in Linux. >> >> Do all application or glibc calls to write pass through the kernel call >> sys_write() (in fs/read_write.c)? > >nope. you also have sys_pwrite, sys_writev and write by ways of mmap. What about a bunch of other write functions in read_write.c (vfs_write etc)? Are they called directly or only used by sys_write, sys_pwrite, sys_writev and mmap? What about ioctl? >> Do all file operations pass through sys_open in fs/open.c? >Basically, if I >> wanted to track which file is opened (for read/write/exec), >would sys_open >> be the function to watch? > >nope. for example, sys_execve does not "sys_open" the file b4 executing >it. Sorry, let me rephrase the question. Do all files that are opened for writing pass through sys_open? Also, what would be the place to place a function that reads a file at kernel initialization? And where should the file be placed - /etc or /boot? Thanks, Siddhartha -- Kernelnewbies: Help each other learn about the Linux kernel. Archive: http://mail.nl.linux.org/kernelnewbies/ FAQ: http://kernelnewbies.org/faq/
