Hi all,

I'm writing a kernel module that hooks the open() syscall (yes I know Linus hates this, but it's for an assignment so I don't have much of a choice) and makes a note whenever an attempt is made to open() something in /tmp. However, simply checking whether the filename argument to open() starts with "/tmp/" is not enough, because of relative paths, "..", symlinks etc. So I need a more reliable way to verify that the filename argument to open() resolves to something in /tmp. In user space there's the realpath() function in stdlib, but how does one do that in kernel mode?

Thanks in advance,

Alphons

Look into the getdents calls. They return the list of inodes and paths in a structure for your viewing pleasure. Also, this is the call that gets the directory structure when a directory is listed. It may fit your purposes or at least point you in the right direction.

Regards,

Alunduil

1 members found this post helpful.

Will do, thanks.