how can a daemon get notified when a system call is made

Hi ,

I want to write a daemon which would do some action whenever a open/ create system call is made.

could anybody help me about this.

Thanks in advance..

You mean open/creat from your own programs, or any process on the system ?

Daemon should get a signal when any process on the system makes the open/ create system call.

BR,

The strace utility can attach to any running process and log the syscalls the process calls. By reading its sources you can probably find out how this is done.

Logging any (instead of selected processes) syscall that happens on an entire system may not be possible (or very difficult/intrusive) the strace-way (i.e. without an special kernel module). It seems that is exactly what this software did to be able to track any syscall. I suggest trying to read its sources, or just use it.

Hope this helps

Thanks for the input..

selinux, auditd, lsm?

Originally Posted by jcookeman selinux, auditd, lsm?

LSM stands for "Linux Security Modules" framework and is equal to say the "Netfilter" framework or "DBUS" in the way that other applications may use it. In the case of the LSM two well-known "users" are SE-Linux and GRSecurity. Auditd, the audit daemon, allows you to maintain a (plaintext) database of rules with which to track for instance system call usage. However just like the previous Dnotify and current Inotify implementation it has a usability issue. You can not set a watch ("-w") on a directory and expect system calls to be monitored recursively, you'll have to set a watch for each file. You could combine things and set watches for static files in system directories where changes are not expected (OK, that depends...) and use Inotify for directories with volatile contents.

Originally Posted by Hko Logging any (instead of selected processes) syscall that happens on an entire system may not be possible (or very difficult/intrusive) the strace-way (i.e. without an special kernel module). It seems that is exactly what this software did to be able to track any syscall.

SysCallTrack was developed for the 2.4 kernel and never ported to 2.6. Unfortunate because it was very easy to work with. Current 2.6 kernels do have Kprobes builtin meaning you can use SystemTap or else try LTTng, LTTV, LKST. Other options to intercept syscalls could use something LD_PRELOADed or a kernel module, but since the OP doesn't provide any details it'll be hard to guesstimate what will be the "way bestest" option...