zfs_acl_chmod auditing

Jonathan Adams

2010-08-16 12:38:18 UTC

Post by Joeri Vanthienen
Hi,
I want to check which process is changing permissions and the path of the file the process has changed.
process is no problem, but can't find a way to extract the path from the zfsvfs_t type.

You want "zfs_acl_chmod_setattr()" (which calls zfs_acl_chmod()); the effected
path is in:

stringof(args[0]->z_vnode->v_path)

(The zfsvfs you were looking at is shared by all vnodes in a filesystem, so
there's no way to get back to the vnode from it)

Cheers,
- jonathan

Post by Joeri Vanthienen
#!/usr/sbin/dtrace -s
fbt:zfs:zfs_acl_chmod:entry
{
trace(uid);
trace(pid);
trace(execname);
self->path = ((zfsvfs_t*)arg0)->z_root;
}
fbt:zfs:zfs_acl_chmod:return
{
printf("z_root node %d\n",self->path);
}
...
dtrace: script './zfschmoddtrace' matched 2 probes
CPU ID FUNCTION:NAME
7 44525 zfs_acl_chmod:entry 0 675 smbd
7 44526 zfs_acl_chmod:return z_root node 4
7 44525 zfs_acl_chmod:entry 0 675 smbd
7 44526 zfs_acl_chmod:return z_root node 4
7 44525 zfs_acl_chmod:entry 0 675 smbd
7 44526 zfs_acl_chmod:return z_root node 4
7 44525 zfs_acl_chmod:entry 1 673 idmapd
7 44526 zfs_acl_chmod:return z_root node 4
...
Loading modules: [ unix genunix specfs dtrace mac cpu.generic uppc pcplusmp scsi_vhci zfs sata sd sockfs ip hook neti sctp arp usba uhci stmf lofs idm mpt nfs random smbsrv cpc crypto logindmux ptm nsctl sdbc ufs nsmb sv rdc ii ]

zfs_acl_chmod::nm -f ctype

C Type
void (*)(zfsvfs_t *, uint64_t, zfs_acl_t *)
--
This message posted from opensolaris.org
_______________________________________________
dtrace-discuss mailing list