forked from iovisor/bcc
-
Notifications
You must be signed in to change notification settings - Fork 0
/
mountsnoop_example.txt
44 lines (37 loc) · 2.61 KB
/
mountsnoop_example.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
Demonstrations of mountsnoop.
mountsnoop traces the mount() and umount syscalls system-wide. For example,
running the following series of commands produces this output:
# mount --bind /mnt /mnt
# umount /mnt
# unshare -m
# mount --bind /mnt /mnt
# umount /mnt
# ./mountsnoop.py
COMM PID TID MNT_NS CALL
mount 13207 13207 4026531841 mount("/dev/loop0", "tmp-dir/", "ext4", 0x0, "") = 0
mount 13207 13207 4026531841 umount("tmp-dir/", 0x0) = 0
fsmount 13224 13224 4026531841 fsopen("ext4", 0x0) = 5
fsmount 13224 13224 4026531841 fsconfig(5, FSCONFIG_SET_FLAG, "rw", "", 0) = 0
fsmount 13224 13224 4026531841 fsconfig(5, FSCONFIG_SET_STRING, "source", "/dev/loop0", 0) = 0
fsmount 13224 13224 4026531841 fsconfig(5, FSCONFIG_CMD_CREATE, "", "", 0) = 0
fsmount 13224 13224 4026531841 fsmount(5, 0x0, MOUNT_ATTR_RDONLY) = 6
fsmount 13224 13224 4026531841 move_mount(6, "", AT_FDCWD, "./tmp-dir/", MOVE_MOUNT_F_EMPTY_PATH) = 0
fsmount 13224 13224 4026531841 umount("./tmp-dir/", 0x0) = 0
# ./mountsnoop.py -P
COMM PID TID PCOMM PPID MNT_NS CALL
mount 13393 13393 bash 13392 4026531841 mount("/dev/loop0", "tmp-dir/", "ext4", 0x0, "") = 0
mount 13393 13393 bash 13392 4026531841 umount("tmp-dir/", 0x0) = 0
fsmount 13409 13409 bash 13408 4026531841 fsopen("ext4", 0x0) = 5
fsmount 13409 13409 bash 13408 4026531841 fsconfig(5, FSCONFIG_SET_FLAG, "rw", "", 0) = 0
fsmount 13409 13409 bash 13408 4026531841 fsconfig(5, FSCONFIG_SET_STRING, "source", "/dev/loop0", 0) = 0
fsmount 13409 13409 bash 13408 4026531841 fsconfig(5, FSCONFIG_CMD_CREATE, "", "", 0) = 0
fsmount 13409 13409 bash 13408 4026531841 fsmount(5, 0x0, MOUNT_ATTR_RDONLY) = 6
fsmount 13409 13409 bash 13408 4026531841 move_mount(6, "", AT_FDCWD, "./tmp-dir/", MOVE_MOUNT_F_EMPTY_PATH) = 0
fsmount 13409 13409 bash 13408 4026531841 umount("./tmp-dir/", 0x0) = 0
The output shows the calling command, its process ID and thread ID, the mount
namespace the call was made in, and the call itself.
The mount namespace number is an inode number that uniquely identifies the
namespace in the running system. This can also be obtained from readlink
/proc/$PID/ns/mnt.
Note that because of restrictions in BPF, the string arguments to either
syscall may be truncated.