|
The printk buffer is periodically written to the /var/log/messages. So
when you unmount the partition the printk buffs are flushed so the message
is seen immediately. From: kernelnewbies-bounce@xxxxxxxxxxxx [mailto:kernelnewbies-bounce@xxxxxxxxxxxx] On Behalf Of Dipti Pawar Sent: Friday, June 10, 2005 11:36 AM To: 'KERNEL' Subject: Intercepting unlink system call Hi I am
intercepting unlink system call and trying to print a
message. But
after inserting the module I cannot see the message in /var/log/messages file
every time I remove a file. Sometimes
I can see the message but not always. Whereas
if I mount a partition, create a file in it and delete that file and unmount the
partition I can see the message in /var/log/messages file
immediately. Can anyone please tell the reason for
this behavior? Following
is sample code that I’m using. /*
Compilation options: gcc -Wall
-DMODULE -D__KERNEL__ -DLINUX -c -o my_unlink.o my_unlink.c
*/ #include
<linux/kernel.h> #include
<linux/unistd.h> #include
<linux/module.h> #include
<linux/linkage.h> unsigned
long *mod_sys_call_table=(unsigned
long *)0xc030a0f0; /* this address can be
found by command grep
sys_call_table /boot/System.map-2.4.26 where 2.4.26 is system release
which can change and can be obtained by uname
-r*/ asmlinkage
unsigned long (*original_call)(const char*); asmlinkage
long our_sys_unlink(const char
*filename ) { printk("File is about to get deleted "
);
/* print a message when a file is to be
deleted*/
printk("%s",filename); return original_call(filename);
/* call the function at orignal address to remove the
file*/ } int
init_module() { printk("<1> In init function\n ");
original_call=
mod_sys_call_table[__NR_unlink-1];
/* save the original address*/
mod_sys_call_table[__NR_unlink-1]=our_sys_unlink;
/* replace the address by our
function*/ return
0; } int
cleanup_module() {
mod_sys_call_table[__NR_unlink-1]=original_call;
/* replace orignal address again while
exiting*/ return
0; } http://www.patni.com World-Wide Partnerships. World-Class Solutions. _____________________________________________________________________ This e-mail message may contain proprietary, confidential or legally privileged information for the sole use of the person or entity to whom this message was originally addressed. Any review, e-transmission dissemination or other use of or taking of any action in reliance upon this information by persons or entities other than the intended recipient is prohibited. If you have received this e-mail in error kindly delete this e-mail from your records. If it appears that this mail has been forwarded to you without proper authority, please notify us immediately at netadmin@xxxxxxxxx and delete this mail. _____________________________________________________________________ |
