On Mon, Nov 10, 2008 at 4:28 PM, Anuz Pratap Singh Tomar
<chambilkethakur@xxxxxxxxx> wrote:
> Why would a kernel module be required for that?
> I guess that can be done in user space as well.
>
> Regards
> Anuz
>
> On Mon, Nov 10, 2008 at 2:36 PM, ashish mahamuni <ashitpro@xxxxxxxxxxx>
> wrote:
>>
>> Hello All,
>>
>> I am trying to write a module which will log the user who deleted the
>> file...
>> So, I am thinking of hooking the unlink system call...
why do you need to hook a system call ?? Why isn't a printk
sufficient. I added this in my fs/namei.c
static long do_unlinkat(int dfd, const char __user *pathname)
{
................
if (error)
return error;
error = -EISDIR;
if(current->uid)
printk("User [%d] pid [%d] tried to delete \"%s\"\n", current->uid,
current->pid, name);
.........
and it works for me as below
[katiyar@localhost ~]$ echo hi > manish
[katiyar@localhost ~]$ rm manish
User [512] pid [2072] tried to delete "manish"
[katiyar@localhost ~]$ tail -1 /var/log/messages
Nov 10 07:15:31 localhost kernel: User [512] pid [2072] tried to delete "manish"
Is there something else that you want ??
Thanks -
Manish
>> Which is the best way to achieve this?
>> Is it possible in 2.6 kernel?
>>
>> Regards
>> Ashish
>>
>>
>> Add more friends to your messenger and enjoy! Go to
>> http://messenger.yahoo.com/invite/
>>
>>
>> --
>> To unsubscribe from this list: send an email with
>> "unsubscribe kernelnewbies" to ecartis@xxxxxxxxxxxx
>> Please read the FAQ at http://kernelnewbies.org/FAQ
>>
>
>
--
To unsubscribe from this list: send an email with
"unsubscribe kernelnewbies" to ecartis@xxxxxxxxxxxx
Please read the FAQ at http://kernelnewbies.org/FAQ
