CODEWITHSUNDEEP
linuxkernel
thegrizzlybear
thegrizzlybear

Reputation: 61

How to use proc_pid_cmdline in kernel module

I am writing a kernel module to get the list of pids with their complete process name. The proc_pid_cmdline() gives the complete process name;using same function /proc/*/cmdline gets the complete process name. (struct task_struct) -> comm gives hint of what process it is, but not the complete path.

I have included the function name, but it gives error because it does not know where to find the function.

How to use proc_pid_cmdline() in a module ?

Upvotes: 5

Views: 2988

Answers (4)

Ariel Silver
Ariel Silver

Reputation: 91

getting the path of a process in the kernel in a thread safe way is manageable.
Check how I did it in my project:
Get path of current task
In my project I get the path of the current task. If you need to get the path a different task, just modify the function to get a task_struct as a parameter and use it instead current.

If you found the project helpful, feel free to star it ;)

Upvotes: 0

Ethan Heilman
Ethan Heilman

Reputation: 16868

To get the full path of the binary behind a process. 

char * exepathp;

struct file * exe_file;
struct mm_struct *mm;
char exe_path [1000];

//straight up stolen from get_mm_exe_file   
mm = get_task_mm(current);
down_read(&mm->mmap_sem); //lock read
exe_file = mm->exe_file;
if (exe_file) get_file(exe_file);
up_read(&mm->mmap_sem); //unlock read

//reduce exe path to a string
exepathp = d_path( &(exe_file->f_path), exe_path, 1000*sizeof(char) );

Where current is the task struct for the process you are interested in. The variable exepathp gets the string of the full path. This is slightly different than the process cmd, this is the path of binary which was loaded to start the process. Combining this path with the process cmd should give you the full path.

Upvotes: 1

Guru Prasad
Guru Prasad

Reputation: 4223

I have managed to solve a version of this problem. I wanted to access the cmdline of all PIDs but within the kernel itself (as opposed to a kernel module as the question states), but perhaps these principles can be applied to kernel modules as well?

What I did was, I added the following function to fs/proc/base.c

int proc_get_cmdline(struct task_struct *task, char * buffer) {
    int i;
    int ret = proc_pid_cmdline(task, buffer);

    for(i = 0; i < ret - 1; i++) {
           if(buffer[i] == '\0')
                   buffer[i] = ' ';
   }
    return 0;
}

I then added the declaration in include/linux/proc_fs.h
int proc_get_cmdline(struct task_struct *, char *);

At this point, I could access the cmdline of all processes within the kernel. To access the task_struct, perhaps you could refer to kernel: efficient way to find task_struct by pid?.

Once you have the task_struct, you should be able to do something like: 

char cmdline[256];    
proc_get_cmdline(task, cmdline);
if(strlen(cmdline) > 0)
    printk("  cmdline :%s\n", cmdline);
else
    printk("  cmdline :%s\n", task->comm);

I was able to obtain the commandline of all processes this way.

Upvotes: 1

wallyk
wallyk

Reputation: 57774

You are not supposed to call proc_pid_cmdline().

It is a non-public function in fs/proc/base.c:

static int proc_pid_cmdline(struct seq_file *m, struct pid_namespace *ns,
                            struct pid *pid, struct task_struct *task)

However, what it does is simple:

get_cmdline(task, m->buf, PAGE_SIZE);

That is not likely to return the full path though and it will not be possible to determine the full path in every case. The arg[0] value may be overwritten, the file could be deleted or moved, etc. A process may exec() in a way which obscures the original command line, and all kinds of other maladies.

A scan of my Fedora 20 system /proc/*/cmdline turns up all kinds of less-than-useful results:

-F
BUG:
WARNING: at
WARNING: CPU:
INFO: possible recursive locking detecte
ernel BUG at
list_del corruption
list_add corruption
do_IRQ: stack overflow:
ear stack overflow (cur:
eneral protection fault
nable to handle kernel
ouble fault:
RTNL: assertion failed
eek! page_mapcount(page) went negative!
adness at
NETDEV WATCHDOG
ysctl table check failed
: nobody cared
IRQ handler type mismatch
Machine Check Exception:
Machine check events logged
divide error:
bounds:
coprocessor segment overrun:
invalid TSS:
segment not present:
invalid opcode:
alignment check:
stack segment:
fpu exception:
simd exception:
iret exception:
/var/log/messages
--
/usr/bin/abrt-dump-oops
-xtD

Upvotes: 2

Related Questions