Finding the implementation of system calls in the linux kernel

Question

I am looking for implementations of open() , close() , write() and unlink() , but I cannot find them anywhere! Each function found is similar to sys_open , do_open , etc_open ... but nothing with the interface we use. Can you help me?

I need to find out what security checks they do.

Answer 1

You need to look for the SYSCALL_DEFINE macro in the kernel sources. For example, grepping for unlink at /fs gives the following:

$ grep -r -n SYSCALL_DEFINE *.c | grep unlink

 namei.c:2811:SYSCALL_DEFINE3(unlinkat, int, dfd, const char __user *, pathname, int, flag) namei.c:2822:SYSCALL_DEFINE1(unlink, const char __user *, pathname) 

Note that the number after SYSCALL_DEFINE is the syscall call response counter.

Answer 2

If you mean library calls, such as those found in fcntl.h , they are not part of the kernel, they are part of glibc .

If you reference actual kernel calls, the sys_xyzzy system call is usually handled by the sys_xyzzy function.

The entry.S file, at least in version 2.4 (I did not look at later kernels), contained tables for mapping system calls to functions:

 .data ENTRY(sys_call_table) .long SYMBOL_NAME(sys_ni_syscall) /* 0 - old "setup()" system call*/ .long SYMBOL_NAME(sys_exit) .long SYMBOL_NAME(sys_fork) .long SYMBOL_NAME(sys_read) .long SYMBOL_NAME(sys_write) .long SYMBOL_NAME(sys_open) /* 5 */ .long SYMBOL_NAME(sys_close) .long SYMBOL_NAME(sys_waitpid) .long SYMBOL_NAME(sys_creat) .long SYMBOL_NAME(sys_link) .long SYMBOL_NAME(sys_unlink) /* 10 */ .long SYMBOL_NAME(sys_execve) .long SYMBOL_NAME(sys_chdir) .long SYMBOL_NAME(sys_time) .long SYMBOL_NAME(sys_mknod) .long SYMBOL_NAME(sys_chmod) /* 15 */ : .long SYMBOL_NAME(sys_ni_syscall) /* sys_remap_file_pages */ .long SYMBOL_NAME(sys_ni_syscall) /* sys_set_tid_address */ 

KernelGrok seems to have a useful page showing system calls, their names, parameters, and where to look for the source. For example (slightly reformatted):

  0 sys_restart_syscall eax = 0x00 kernel/signal.c:2058 1 sys_exit eax = 0x01 ebx = int error_code kernel/exit.c:1046 2 sys_fork eax = 0x02 ebx = struct pt_regs * arch/alpha/kernel/entry.S:716 3 sys_read eax = 0x03 ebx = unsigned int fd ecx = char __user *buf edx = size_t count fs/read_write.c:391 4 sys_write eax = 0x04 ebx = unsigned int fd ecx = const char __user *buf edx = size_t count fs/read_write.c:408 : 

etc. But, as an old school, I prefer to store the kernel source files and just use grep