This is the mail archive of the
systemtap@sourceware.org
mailing list for the systemtap project.
RE: systemtap question
- From: "Stone, Joshua I" <joshua dot i dot stone at intel dot com>
- To: "Frank Ch. Eigler" <fche at redhat dot com>, "Anthony Green" <green at redhat dot com>
- Cc: <systemtap at sources dot redhat dot com>
- Date: Wed, 6 Sep 2006 11:27:37 -0700
- Subject: RE: systemtap question
On Wednesday, September 06, 2006 6:36 AM, Frank Ch. Eigler wrote:
> Hi -
>
> green@redhat.com wrote:
>
>> I have a customer who wants certain system files to have
>> non-standard file permissions, but some cron job keeps changing them
>> back every night. He'd like to figure out who is doing this.
>
> OK.
>
>> Is this the kind of thing systemtap could help with? Do you have
>> any examples that are similar to this?
Here's a tiny script that probes the chmod syscall, and prints the
calling process and walks the process "stack". You might also have to
probe fchmod, but it's more difficult to account that since you only get
the file descriptor.
Josh
probe syscall.chmod {
printf("%5d %-16s %s -> %#o\n", tid(), execname(), path, mode)
printf(" ^\n")
for (t = task_parent(task_current()); task_tid(t) != 0; t =
task_parent(t)) {
printf(" | %5d %s\n", task_tid(t), task_execname(t))
}
printf(" ------------------------\n")
}