diff -Nrup a/fs/exec.c b/fs/exec.c --- a/fs/exec.c 2011-05-20 08:42:16.307336825 +0200 +++ b/fs/exec.c 2011-05-20 08:44:59.390964372 +0200 @@ -56,6 +56,8 @@ #include #include +#include + #include #include #include @@ -140,6 +142,10 @@ SYSCALL_DEFINE1(uselib, const char __use fsnotify_open(file); + tmp = getname(library); + trace_uselib(tmp); + putname(library); + error = -ENOEXEC; if(file->f_op) { struct linux_binfmt * fmt; @@ -743,6 +749,8 @@ struct file *open_exec(const char *name) fsnotify_open(file); + trace_open_exec(name); + err = deny_write_access(file); if (err) goto exit; diff -Nrup a/fs/open.c b/fs/open.c --- a/fs/open.c 2011-05-20 08:42:17.924811741 +0200 +++ b/fs/open.c 2011-05-20 08:44:59.390964372 +0200 @@ -33,6 +33,9 @@ #include "internal.h" +#define CREATE_TRACE_POINTS +#include + int do_truncate(struct dentry *dentry, loff_t length, unsigned int time_attrs, struct file *filp) { @@ -1005,6 +1008,7 @@ long do_sys_open(int dfd, const char __u } else { fsnotify_open(f); fd_install(fd, f); + trace_do_sys_open(tmp, flags, mode); } } putname(tmp); diff -Nrup a/include/trace/events/fs.h b/include/trace/events/fs.h --- a/include/trace/events/fs.h 1970-01-01 02:00:00.000000000 +0200 +++ b/include/trace/events/fs.h 2011-05-20 08:46:14.181001478 +0200 @@ -0,0 +1,71 @@ +#undef TRACE_SYSTEM +#define TRACE_SYSTEM fs + +#if !defined(_TRACE_FS_H) || defined(TRACE_HEADER_MULTI_READ) +#define _TRACE_FS_H + +#include +#include + +TRACE_EVENT(do_sys_open, + + TP_PROTO(char *filename, int flags, int mode), + + TP_ARGS(filename, flags, mode), + + TP_STRUCT__entry( + __string( filename, filename ) + __field( int, flags ) + __field( int, mode ) + ), + + TP_fast_assign( + __assign_str(filename, filename); + __entry->flags = flags; + __entry->mode = mode; + ), + + TP_printk("\"%s\" %x %o", + __get_str(filename), __entry->flags, __entry->mode) +); + +TRACE_EVENT(uselib, + + TP_PROTO(char *filename), + + TP_ARGS(filename), + + TP_STRUCT__entry( + __string( filename, filename ) + ), + + TP_fast_assign( + __assign_str(filename, filename); + ), + + TP_printk("\"%s\"", + __get_str(filename)) +); + +TRACE_EVENT(open_exec, + + TP_PROTO(char *filename), + + TP_ARGS(filename), + + TP_STRUCT__entry( + __string( filename, filename ) + ), + + TP_fast_assign( + __assign_str(filename, filename); + ), + + TP_printk("\"%s\"", + __get_str(filename)) +); + +#endif /* _TRACE_FS_H */ + +/* This part must be outside protection */ +#include