On Mon, Jun 28, 2004 at 12:55:34 +0530, Siddhartha Jain wrote: > Thanks Nir, > > >> I want understand the flow of write operations in Linux. > >> > >> Do all application or glibc calls to write pass through the kernel call > >> sys_write() (in fs/read_write.c)? > > > >nope. you also have sys_pwrite, sys_writev and write by ways of mmap. > > What about a bunch of other write functions in read_write.c (vfs_write etc)? > Are they called directly or only used by sys_write, sys_pwrite, sys_writev > and mmap? All syscalls are called sys_something. Nothing else may ever be called from userspace. On the other hand, sys_anything is almost never called from kernel. Note also, that mmap does not call anything. It is the memory manager, that calls address_space->write_page on dirty pages -- and they might have been dirtied by writing (via sys_write/pwrite/writev and the ->write method) or directly by write to mapped memory. > What about ioctl? It's a sys_ioctl syscall... > >> Do all file operations pass through sys_open in fs/open.c? > >Basically, if I > >> wanted to track which file is opened (for read/write/exec), > >would sys_open > >> be the function to watch? > > > >nope. for example, sys_execve does not "sys_open" the file b4 executing > >it. > > Sorry, let me rephrase the question. Do all files that are opened for > writing pass through sys_open? Yes, they do. And all files, even when executing, do pass through dentry_open. But what you really want is to get the Linux Security Modules patch and use the hooking points provided by it. > Also, what would be the place to place a function that reads a file at > kernel initialization? And where should the file be placed - /etc or /boot? Nowhere. Kernel must not read configuration files. You should have an interface (proc file, device or netlink socket) and feed the data by user-land utility. ------------------------------------------------------------------------------- Jan 'Bulb' Hudec <bulb@ucw.cz>
Attachment:
signature.asc
Description: Digital signature
