How to traverse all file struct

[cmqycmqy]

>> (Again, depending I just want to print process info whitch have open a
>> specific file£¨inode£©. Then if i want to delete a file in use,i can just kill
>>the process one by one.
 
>No kernel hacking needed for that, you can do it in userspace.
 
># lsof | grep /your/file/here
># kill -9 ` lsof | grep /your/file/here | awk '{print $2} |uniq '`

Thank you very much for telling me those command.  In fact, I want to write a rootkit check tool, I don't trust anything in user space. and I always want to known how to get the information by myself. Maybe i should check the source code of lsof, but it is really a difficult thing for me
 		 	   		  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.kernelnewbies.org/pipermail/kernelnewbies/attachments/20150428/3515518c/attachment.html