Search code examples
cunixsystem-callsln

System Calls: Interpreting ktrace output

While learning for an upcoming exam, I encoutered the following problem:

Which was the UNIX command that the user tried to execute? What's happening in the lines that are marked with a * ? What was the problem?

I've figured out that the user probably wanted to execute something like

ln -s dir ls

But that doesn't give me the expected output.

enter image description here

Solution

  • So I managed to answer the question myself.

    The command that the user tries to execute is ln ls dir, which basically targets using the word dir as an 'alias' for the ls command.

    That goes wrong because the user tries to operate in a directory which doesn't grant write-permissions to him (most probably the /bin directory), which means that he isn't able to create a file (the hardlink) in this directory.

    By using ktrace/kdump I managed to reproduce the output:

      [...]
 *77019 ln       CALL  stat(0x7fffffffebab,0x7fffffffd668)
  77019 ln       NAMI  "test/ls"
  77019 ln       RET   stat 0
 *77019 ln       CALL  lstat(0x7fffffffebb3,0x7fffffffd668)
  77019 ln       NAMI  "test/dir"
  77019 ln       RET   lstat -1 errno 2 No such file or directory
 *77019 ln       CALL  stat(0x7fffffffebb3,0x7fffffffd668)
  77019 ln       NAMI  "test/dir"
  77019 ln       RET   stat -1 errno 2 No such file or directory
 *77019 ln       CALL  lstat(0x7fffffffebb3,0x7fffffffd668)
  77019 ln       NAMI  "test/dir"
  77019 ln       RET   lstat -1 errno 2 No such file or directory
 *77019 ln       CALL linkat(AT_FDCWD,0x7fffffffebab,AT_FDCWD,0x7fffffffebb3,0x400)
  77019 ln       NAMI  "test/ls"
  77019 ln       NAMI  "test/dir"
  77019 ln       RET   linkat -1 errno 13 Permission denied
  [...]
 *77019 ln       CALL  exit(0x1)

    The steps marked with a star can be explained as follows:

    The first syscall is to gather the inode information of the original file (´test/ln). Next, it checks whether the target file (test/dir) already exists, either as a named file (stat) or as a symbolic link (lstat).

    Because this is not the case, the process tries to link the files (linkat- in the original example: link). As mentioned earlier this goes wrong because of permissions.

    The process finally finishes with a negative exit code.