VFS full_audit - vfs_op_names gives wrong value [WAS: VFS modul - understanding operations - help needed]

[Mario Minati]

Mario Minati schrieb:

> Jeremy Allison schrieb:
>
>> On Fri, Oct 14, 2005 at 12:37:50AM +0200, Mario Minati wrote:
>>  
>>
>>> Now my problem:
>>> At the moment I am quite confused by the load of operations created 
>>> by e.g. a new directory. While I am monitoring samba with the 
>>> full_audit VFS modul I get no mkdir. The only message that is 
>>> somehow connected to that new directory is open with 'w' flag. The 
>>> unlink operation is an other example, in a few minutes of surfing 
>>> through the dir tree I get a few hundreds of them without deleting 
>>> anything.
>>> So I would like to know where I can find out about when which 
>>> operation is called.
>>> Is there some information in the sourcecode? I only read the modules 
>>> files so far and I couldn't find any usefull informations in the 
>>> CIFS documentation or the other samba developer doucments.
>>>   
>>
>>
>> *All* filesystem operations go through the VFS layer. There is no
>> other way the smbd code can touch the underlying filesystem.
>>
>> In the source code grep for SMB_VFS_ within all C files to see
>> where all the VFS calls are.
>>
>> Read the source code to discover how things are used - that's what
>> it is for !
>>
>> Jeremy.
>>
>>  
>>
> Hi,
> the last days I learned quite a bit of how samba is working internaly, 
> yet I am far from being an expert. ;-)
>
> When I was stepping through smbd (3.0.14 - debian source) with gdb on 
> a trans2 message asking for ALL_INFO there was a call to unix_convert 
> which calls SMB_VFS_STAT to check if a file (".") exists. That was 
> fine so far.
> Through this VFS call, the full_audit VFS..._stat function (line 1029) 
> was called - as expected - but it returns *'unlink'* as operation name 
> instead of 'stat'.
> I printed the variables in function audit_opname, line 672:
> op was SMB_VFS_OP_STAT as expected
> vfs_op_names[op].name delivered 'unlink' which I don't understand.
>
> I compared the definitions of vfs_op_names in vfs_full_audit.c and 
> vfs.h and can't find any differences, except that the SMB_VFS_OP_NULL 
> at the beginning is missing, but that shouldn't be a problem, right?
>
> Can you help me hunt this thing down?
>
> Greets,
> Mario
>
Hi @all,
I found the reason, the vfs_op_names struct is wrong and there is at 
least one more minor bug.
I'll post a patch soon.

Greets,
Mario