textvp_fullpath

[Robert Watson]

On Fri, 15 Aug 2008, Uladzislau Rezki wrote:

> We have to to do a few thinks:
>
> 1) do original "write" sys call;
> 2) get full path (/etc/passwd);
> 3) put all this information to user land through the character device.
>
> I get stuck in point 2. I need to get full path, but how ...

In FreeBSD 6.2 and higher, the kernel event auditing facility provides exactly 
this service already.  Take a look at the auditpipe(4) facility for details of 
the run-time monitoring aspect of that.

Robert N M Watson
Computer Laboratory
University of Cambridge