How to traverse all file struct
I want to travese(find out) all opened file struct, but the s_files in struct super_block is not exit any more.how can i do that? why i want to do this is that i want to find out all process that have open that file. Is there any suggestion?
On Mon, 27 Apr 2015 15:41:31 -0000, cmqycmqy said:
I want to travese(find out) all opened file struct
Actually, no, you don't.
i want to find out all process that have open that file.
Hint: There's probably a faster way to do it than checking *all* open files. You can probably do even better if you explain *why* you want to find all processes. If you find them, what do you intend to do? (Again, depending on what you're trying to do, there's probably an easier way).
I want to travese(find out) all opened file struct Actually, no, you don't. Ok,are there no list to manage all file struct,it is really not convenience. i want to find out all process that have open that file.
Hint: There's probably a faster way to do it than checking *all* open files.
You can probably do even better if you explain *why* you want to find all processes. If you find them, what do you intend to do? (Again, depending I just want to print process info whitch have open a specific file（inode）. Then if i want to delete a file in use,i can just kill the process one by one. on what you're trying to do, there's probably an easier way). Are there a easier way in this scene?
Kernelnewbies mailing list Kernelnewbies@kernelnewbies.org http://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies
On Tue, 28 Apr 2015 00:58:47 -0000, cmqycmqy said:
(Again, depending I just want to print process info whitch have open a specific file£¨inode£©. Then if i want to delete a file in use,i can just kill the process one by one.
No kernel hacking needed for that, you can do it in userspace. # lsof | grep /your/file/here # kill -9 ` lsof | grep /your/file/here | awk '{print $2} |uniq '`
(Again, depending I just want to print process info whitch have open a specific file£¨inode£©. Then if i want to delete a file in use,i can just kill the process one by one.
No kernel hacking needed for that, you can do it in userspace.
# lsof | grep /your/file/here # kill -9 ` lsof | grep /your/file/here | awk '{print $2} |uniq '`
Thank you very much for telling me those command. In fact, I want to write a rootkit check tool, I don't trust anything in user space. and I always want to known how to get the information by myself. Maybe i should check the source code of lsof, but it is really a difficult thing for me
participants (2)
-
cmqycmqy -
Valdis.Kletnieks＠vt.edu