RE: systemtap question

["Stone, Joshua I" <joshua dot i dot stone at intel dot com>]

On Wednesday, September 06, 2006 6:36 AM, Frank Ch. Eigler wrote:
> Hi -
> 
> green@redhat.com wrote:
> 
>> I have a customer who wants certain system files to have
>> non-standard file permissions, but some cron job keeps changing them
>> back every night.  He'd like to figure out who is doing this.
> 
> OK.
> 
>> Is this the kind of thing systemtap could help with?  Do you have
>> any examples that are similar to this?

Here's a tiny script that probes the chmod syscall, and prints the
calling process and walks the process "stack".  You might also have to
probe fchmod, but it's more difficult to account that since you only get
the file descriptor.

Josh


probe syscall.chmod {
  printf("%5d %-16s %s -> %#o\n", tid(), execname(), path, mode)
  printf(" ^\n")
  for (t = task_parent(task_current()); task_tid(t) != 0; t =
task_parent(t)) {
    printf(" | %5d %s\n", task_tid(t), task_execname(t))
  }
  printf(" ------------------------\n")
}