我正在尝试钩住unlinkat.my钩子函数。
但是我只得到了文件名,而不是绝对path.so,我想要绝对路径来比较,我试了rm -r,如果我得到了绝对路径,那么works.so,请告诉我我是如何得到绝对路径的。
我的代码是
long mw_sys_unlink(int dfd, const char *filename ,int flag)
{
long ret;
if( strstr(filename,"/tmp/a/"))
{
printk(KERN_INFO "file %s has not been deleted by kernel module\n", filename);
return -1;
}
else
{
ret = orig_sys_unlink(dfd ,filename,flag);
printk(KERN_INFO "file %s has been deleted", filename);
return ret;
}
}
发布于 2015-08-24 15:45:42
尝试以下操作:
char *tmp = (char*)__get_free_page(GFP_TEMPORARY);
file *file = fget(dfd);
if (!file) {
goto out
}
char *path = d_path(&file->f_path, tmp, PAGE_SIZE);
if (IS_ERR(path)) {
printk("error: %d\n", (int)path);
goto out;
}
printk("path: %s\n", path);
out:
free_page((unsigned long)tmp);
https://stackoverflow.com/questions/32175346
复制相似问题