Module to print the open files of a process

Linux maintains the information about the current process in a structure task_struct.
A macro named current returns a pointer to the task_struct of the current process.
A process can have one or more open files at any given time. A list of all the open files that any process has can be obtained from the structure task_struct.
The task_struct has a member files, which is of type files_struct.
The structure files_struct maintains the information regarding the files that are being used by the process.
files_struct which is defined in fdtable.h is as follows.

struct files_struct { /* * read mostly part */ atomic_t count; struct fdtable __rcu *fdt; struct fdtable fdtab; /* * written part on a separate cache line in SMP */ spinlock_t file_lock ____cacheline_aligned_in_smp; int next_fd; struct embedded_fd_set close_on_exec_init; struct embedded_fd_set open_fds_init; struct file __rcu * fd_array[NR_OPEN_DEFAULT]; }

The member fdt, in files_struct, of type struct fdtable stores the file descriptors and other relevant pointers for the currently open files.
The struct fdtable which is also defined in fdtable.h is as follows

struct fdtable { unsigned int max_fds; struct file __rcu **fd; /* current fd array */ fd_set *close_on_exec; fd_set *open_fds; struct rcu_head rcu; struct fdtable *next; };

The member open_fds is bitmap of all the open files, and the member fd is a pointer to the array, which stores the pointers to struct file of each of the open file.

The index of the fd array is the file descriptor of the corresponding file.

The struct file has a member f_path which will enable us to get the complete path in the filesystem for the corresponding file.

Thus to get a list of all the open files we need to access the array fd in the structure fdtable.

The function files_fdtable defined in fdtable.h returns a pointer to the fdtable, taking as input the files_struct.

Once we have fdtable we can iterate over the fd array, printing the file path of each fd.

To retrieve the actual path from f_path we need to make use of the function d_path

d_path(const struct path *path, char *buf, int buflen)

defined in fs/dcache.c

Here is module that prints all the open files on being inserted into the kernel.

current_files.c

#include <linux/init.h> #include <linux/module.h> #include<linux/sched.h> #include <linux/rcupdate.h> #include <linux/fdtable.h> #include <linux/fs.h> #include <linux/fs_struct.h> #include <linux/dcache.h> #include <linux/slab.h> MODULE_LICENSE("Dual BSD/GPL"); static int current_init(void) { struct files_struct *current_files; struct fdtable *files_table; unsigned int *fds; int i=0; struct path files_path; char *cwd; char *buf = (char *)kmalloc(GFP_KERNEL,100*sizeof(char)); current_files = current->files; files_table = files_fdtable(current_files); while(files_table->fd[i] != NULL) { files_path = files_table->fd[i]->f_path; cwd = d_path(&files_path,buf,100*sizeof(char)); printk(KERN_ALERT "Open file with fd %d %s", i,cwd); i++; } return 0; } static void current_exit(void) { printk(KERN_ALERT "Goodbye cruel world"); } module_init(current_init); module_exit(current_exit);

Makefile to compile the code

ifneq ($(KERNELRELEASE),) obj-m := current_files.o else KERNELDIR ?= /lib/modules/$(shell uname -r)/build PWD := $(shell pwd) default: $(MAKE) -C $(KERNELDIR) M=$(PWD) modules clean: $(MAKE) -C $(KERNELDIR) M=$(PWD) clean endif

Note: Code tested on 2.6.32


Compile and insert.

make sudo insmod current_files.ko

After inserting into the kernel using insmod, to see the output run the command

dmesg | tail -3 Open file with fd 0 /dev/pts/1 Open file with fd 1 /dev/pts/1 Open file with fd 2 /dev/pts/1

By default all processes have 3 files open the standard input, standard output and the standard error with file descriptors 0,1,2 respectively.
Thus the three values /dev/pts/1 are pointing to the terminal on which we are ran the insmod.
To see how the file path changes if we change one of the three file descriptors, add a redirection to a file of output to a file.

rmmod current_files insmod current_files.ko > temp.log

Now run dmesg.

dmesg | tail -3 Open file with fd 0 /dev/pts/1 Open file with fd 1 /home/user/Desktop/current_files/temp.log Open file with fd 2 /dev/pts/1

The path of file descriptor 2 has changed from the terminal to the new redirected file.