iovisor / iovisor/bcc

how to get file path while tracing unlink system call to track deletion of files

Open
#3,635 7 comments 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
22.7k
Forks
4.1k
Avg merge
10d 4h
Merged PRs (30d)
3

Description

I wanted to trace unlink_at system call to find whether files are getting deleted or not for this solution i used bcc python

```
#!/usr/bin/python3

from bcc import BPF
from time import sleep
import psutil
from bcc.utils import printb
import os

bpf_source='''
#include

BPF_PERF_OUTPUT(events);

struct data_t{
u32 pid;
char fname[NAME_MAX];
char comm[TASK_COMM_LEN];

};
struct sys_enter_unlinkat_args_t{
uint64_t _unused;
u32 nr;
u64 dfd;
char *fname;
u64 flags;
u64 mode;

};

int sys_enter_unlinkat_fn(struct sys_enter_unlinkat_args_t *args)
{

struct data_t data = {};
bpf_get_current_comm(&data.comm, sizeof(data.comm));
bpf_trace_printk("%s",data.comm);

u32 pid = (u32)(bpf_get_current_pid_tgid() >> 32);
u32 tid = (u32)bpf_get_current_pid_tgid();

bpf_trace_printk("unlinkat has occured %d \\n",pid);
data.pid=pid;

bpf_probe_read_str(data.fname,64,args->fname);
events.perf_submit(args,&data,sizeof(data));

return 0;

}
'''

bpf= BPF(text=bpf_source)
bpf.attach_tracepoint(tp="syscalls:sys_enter_unlinkat",fn_name="sys_enter_unlinkat_fn")
print("%s %-16s %-16s %-16s" %("PID","ARG","COMMAND","PATH"))
def print_event(cpu, data, size):
event = bpf["events"].event(data)
printb(b"%d %-16s %-16s " %(event.pid,event.fname,event.comm))

bpf["events"].open_perf_buffer(print_event)
while 1:
try:
bpf.perf_buffer_poll()
except KeyboardInterrupt:
exit()

```
A) Is this the way to track files that are deleted by tracing unlink system call
B)if A is the proper approach then so to achieve file path i just went through issue [#237](https://github.com/iovisor/bcc/issues/237) there are two recommnedations

1)to use dentry and traverse it continuosly but its not recommended for longer run its not recommended
2)to use bpf_dpath but this helper function needs struct file as an input and i am not sure how to get that

please provide your insights on this

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the supplied BCC Python program and its syscalls:sys_enter_unlinkat tracepoint handler. Read issue #237 alongside the unlinkat arguments and BPF helper documentation to assess path availability and the struct file requirement. Done means documenting whether this approach reliably tracks deletions and what supported path-resolution strategy applies.

Written by the indexing model from the issue text.

Assessment

Tech stack
c, linux, python
Domain
observability-sre, operating-systems, tooling
Issue type
Documentation
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.