Re: Kernel hook for open

From: Michael Vines (
Date: Mon Nov 06 2000 - 10:11:11 EST

On Mon, 6 Nov 2000, Erik Mouw wrote:

> On Mon, Nov 06, 2000 at 03:55:41PM +0200, Catalin BOIE wrote:
> > I wish to know if there is something like a kernel hook for open function.
> > I want to monitor a file (someting like watchdog on Solaris) and to read
> > from my own process (module?) and from the file.
> I don't know what watchdog is, but maybe strace is what you want (man
> strace for more info).
> > I tried with LD_SO_PRELOAD but it haven't any effect on the so libraries.
> > For example:
> > If I use function getpwent (that is in a so library) and my home
> > made .so library that overwrite "open" function and is in
> > /etc/ file it doesn't work.
> > Of course, if I use open ("/etc/hosts") the so library execute my
> > function.
> Use LD_PRELOAD instead.

You could also write a simple kernel module that replaces the open system
call. See the Linux Kernel Module Programming Guide for details.



To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
Please read the FAQ at

This archive was generated by hypermail 2b29 : Tue Nov 07 2000 - 21:00:19 EST