Matching close() system calls

[Steve Grubb]

On Wed, 14 Mar 2018 15:51:44 +0300
Kerem Aksu <ahmtkrmd96 at gmail.com> wrote:

> Hello,
> 
> I am trying to trace files by using this rule :
>  "-a always,exit -F arch=b64 -S read,write,open,close -k file_op"
> 
> I can trace open() system calls with the "type=path" log occurred
> with the same ID as the open() system call. I can learn which file is
> opened by that open() system call.

If open returns a non-negative number, then that is the descriptor.
You'll need to match that descriptor as an argument to the other
syscalls for the same pid. You might need to watch exit_group also since
a program exiting closes all descriptors. And also you'll need to check
flags set by open and fcntl to see if CLOEXEC is being set.


> But when it comes to other system calls I am unable to learn which
> file is read, wrote or closed.

This is implicit by referencing the descriptor.
 

> I tried to match arguments passed to system calls (a[0..3]) but those
> are different than the arguments defined in linux man pages. I might
> misunderstand these arguments.

No, they are pretty much the same.


> How can I match these or any other (file) system calls with the files
> that they used onto.
> And when does a "type=PATH" log occurs?

You'll probably need to write a program using auparse to save the
descriptor from an open or openat and then output the information you
need as a custom program.

-Steve