iovisor / bcc

BCC - Tools for BPF-based Linux IO analysis, networking, monitoring, and more
Apache License 2.0
20.59k stars 3.88k forks source link

tools/filegone: Support rename/unlink failed situation #4792

Closed Rtoax closed 1 year ago

Rtoax commented 1 year ago

When deleting or renaming a file or folder for which you do not have permissions, vfs_unlink/rename will fail and we should skip the failure.

Reproducing the problem:

Terminal 1:

    $ sudo ./filegone.py

Terminal 2, failed 1,2,3,4:

    $ sudo touch /etc/a.txt
    $ sudo mkdir /etc/a.dir
    $ # Permission deny
    $ rm -f /etc/a.txt
    rm: cannot remove '/etc/a.txt': Permission denied               << 1
    $ mv /etc/a.txt /etc/b.txt
    mv: cannot move '/etc/a.txt' to '/etc/b.txt': Permission denied << 2
    $ rmdir /etc/a.dir
    rmdir: failed to remove '/etc/a.dir': Permission denied         << 3
    $ mv /etc/a.dir /etc/b.dir
    mv: cannot move '/etc/a.dir' to '/etc/b.dir': Permission denied << 4
    $ # Success gone
    $ sudo mv /etc/a.txt /etc/b.txt
    $ sudo rm /etc/b.txt
    $ sudo mv /etc/a.dir /etc/b.dir
    $ sudo rmdir /etc/b.dir

Then terminal 1, wrong statistic 1,2,3,4:

    $ sudo ./filegone.py
    TIME     PID     COMM             ACTION FILE
    13:32:11 10767   rm               DELETE a.txt                  << 1
    13:32:11 10768   mv               RENAME a.txt > b.txt          << 2
    13:32:11 10769   rmdir            DELETE a.dir                  << 3
    13:32:11 10770   mv               RENAME a.dir > b.dir          << 4
    13:32:11 10772   mv               RENAME a.txt > b.txt
    13:32:11 10774   rm               DELETE b.txt
    13:32:11 10776   mv               RENAME a.dir > b.dir
    13:32:11 10778   rmdir            DELETE b.dir

This commit fix the statistical error above, the result:

    $ sudo ./filegone.py
    TIME     PID     COMM             ACTION FILE
    13:36:52 10937   mv               RENAME a.txt > b.txt
    13:36:52 10939   rm               DELETE b.txt
    13:36:52 10941   mv               RENAME a.dir > b.dir
    13:36:52 10943   rmdir            DELETE b.dir