solved - Re: VFS full_audit - vfs_op_names gives wrong value [WAS: VFS modul - understanding operations - help needed]

[Mario Minati]

Mario Minati schrieb:

> Mario Minati schrieb:
>
>> Jeremy Allison schrieb:
>>
>>> On Fri, Oct 14, 2005 at 12:37:50AM +0200, Mario Minati wrote:
>>>  
>>>
>>>> Now my problem:
>>>> At the moment I am quite confused by the load of operations created 
>>>> by e.g. a new directory. While I am monitoring samba with the 
>>>> full_audit VFS modul I get no mkdir. The only message that is 
>>>> somehow connected to that new directory is open with 'w' flag. The 
>>>> unlink operation is an other example, in a few minutes of surfing 
>>>> through the dir tree I get a few hundreds of them without deleting 
>>>> anything.
>>>> So I would like to know where I can find out about when which 
>>>> operation is called.
>>>> Is there some information in the sourcecode? I only read the 
>>>> modules files so far and I couldn't find any usefull informations 
>>>> in the CIFS documentation or the other samba developer doucments.
>>>>   
>>>
>>>
>>>
>>> *All* filesystem operations go through the VFS layer. There is no
>>> other way the smbd code can touch the underlying filesystem.
>>>
>>> In the source code grep for SMB_VFS_ within all C files to see
>>> where all the VFS calls are.
>>>
>>> Read the source code to discover how things are used - that's what
>>> it is for !
>>>
>>> Jeremy.
>>>
>>>  
>>>
>> Hi,
>> the last days I learned quite a bit of how samba is working 
>> internaly, yet I am far from being an expert. ;-)
>>
>> When I was stepping through smbd (3.0.14 - debian source) with gdb on 
>> a trans2 message asking for ALL_INFO there was a call to unix_convert 
>> which calls SMB_VFS_STAT to check if a file (".") exists. That was 
>> fine so far.
>> Through this VFS call, the full_audit VFS..._stat function (line 
>> 1029) was called - as expected - but it returns *'unlink'* as 
>> operation name instead of 'stat'.
>> I printed the variables in function audit_opname, line 672:
>> op was SMB_VFS_OP_STAT as expected
>> vfs_op_names[op].name delivered 'unlink' which I don't understand.
>>
>> I compared the definitions of vfs_op_names in vfs_full_audit.c and 
>> vfs.h and can't find any differences, except that the SMB_VFS_OP_NULL 
>> at the beginning is missing, but that shouldn't be a problem, right?
>>
>> Can you help me hunt this thing down?
>>
>> Greets,
>> Mario
>>
> Hi @all,
> I found the reason, the vfs_op_names struct is wrong and there is at 
> least one more minor bug.
> I'll post a patch soon.
>
> Greets,
> Mario
>
Hi @all,
forget all about it, the problem is allready solved in the current 
packages I was working with the current Debian packages (3.0.14a).

Greets,
Mario