how to get file path while tracing unlink system call to track deletion of files
- Dominant language
- C
- Stars
- 22.7k
- Forks
- 4.1k
- Avg merge
- 10d 4h
- Merged PRs (30d)
- 3
Description
I wanted to trace unlink_at system call to find whether files are getting deleted or not for this solution i used bcc python
```
#!/usr/bin/python3
from bcc import BPF
from time import sleep
import psutil
from bcc.utils import printb
import os
bpf_source='''
#include
BPF_PERF_OUTPUT(events);
struct data_t{
u32 pid;
char fname[NAME_MAX];
char comm[TASK_COMM_LEN];
};
struct sys_enter_unlinkat_args_t{
uint64_t _unused;
u32 nr;
u64 dfd;
char *fname;
u64 flags;
u64 mode;
};
int sys_enter_unlinkat_fn(struct sys_enter_unlinkat_args_t *args)
{
struct data_t data = {};
bpf_get_current_comm(&data.comm, sizeof(data.comm));
bpf_trace_printk("%s",data.comm);
u32 pid = (u32)(bpf_get_current_pid_tgid() >> 32);
u32 tid = (u32)bpf_get_current_pid_tgid();
bpf_trace_printk("unlinkat has occured %d \\n",pid);
data.pid=pid;
bpf_probe_read_str(data.fname,64,args->fname);
events.perf_submit(args,&data,sizeof(data));
return 0;
}
'''
bpf= BPF(text=bpf_source)
bpf.attach_tracepoint(tp="syscalls:sys_enter_unlinkat",fn_name="sys_enter_unlinkat_fn")
print("%s %-16s %-16s %-16s" %("PID","ARG","COMMAND","PATH"))
def print_event(cpu, data, size):
event = bpf["events"].event(data)
printb(b"%d %-16s %-16s " %(event.pid,event.fname,event.comm))
bpf["events"].open_perf_buffer(print_event)
while 1:
try:
bpf.perf_buffer_poll()
except KeyboardInterrupt:
exit()
```
A) Is this the way to track files that are deleted by tracing unlink system call
B)if A is the proper approach then so to achieve file path i just went through issue [#237](https://github.com/iovisor/bcc/issues/237) there are two recommnedations
1)to use dentry and traverse it continuosly but its not recommended for longer run its not recommended
2)to use bpf_dpath but this helper function needs struct file as an input and i am not sure how to get that
please provide your insights on this
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with the supplied BCC Python program and its syscalls:sys_enter_unlinkat tracepoint handler. Read issue #237 alongside the unlinkat arguments and BPF helper documentation to assess path availability and the struct file requirement. Done means documenting whether this approach reliably tracks deletions and what supported path-resolution strategy applies.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c, linux, python
- Domain
- observability-sre, operating-systems, tooling
- Issue type
- Documentation
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100