Re: Kernel hook for open

[Michael Vines <mjvines@undergrad.math.uwaterloo.ca>]

On Mon, 6 Nov 2000, Erik Mouw wrote:

> On Mon, Nov 06, 2000 at 03:55:41PM +0200, Catalin BOIE wrote:
> > I wish to know if there is something like a kernel hook for open function.
> > I want to monitor a file (someting like watchdog on Solaris) and to read
> > from my own process (module?) and from the file.
> 
> I don't know what watchdog is, but maybe strace is what you want (man
> strace for more info).
> 
> > I tried with LD_SO_PRELOAD but it haven't any effect on the so libraries.
> > For example:
> > If I use function getpwent (that is in a so library) and my home
> > made .so library that overwrite "open" function and is in
> > /etc/ld.so.preload file it doesn't work.
> > Of course, if I use open ("/etc/hosts") the so library execute my
> > function. 
> 
> Use LD_PRELOAD instead.

You could also write a simple kernel module that replaces the open system
call.  See the Linux Kernel Module Programming Guide for details. 
http://www.linuxdoc.org/guides.html

specifically http://www.linuxdoc.org/LDP/lkmpg/node20.html

        Michael
       

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
Please read the FAQ at http://www.tux.org/lkml/