Question

I’m currently working on a project that hooks into various system calls and writes things to a log, depending on which one was called. So, for example, when I change the permissions of a file, I write a little entry to a log file that tracks the old permission and new permission. However, I’m having some trouble pinning down exactly where I should be watching. For the above example, strace tells me that the ‘chmod’ command uses the system call sys_fchmodat(). However, there’s also a sys_chmod() and a sys_fchmod().

I’m sure the kernel developers know what they’re doing, but I wonder: what is the point of all these (seemingly) redundant system calls, and is there any rule on which ones are used for what? (i.e. are the ‘at’ syscalls or ones prefixed with ‘f’ meant to do something specific?)

Answer 1

Yes, there are some naming rules.

• chmod takes a filename, while fchmod takes a file descriptor. Same for stat vs fstat.
• fchmodat takes a file descriptor/filename pair (file descriptor for the directory and filename for the file name within the directory). Same for other *at calls; see the NOTES section of http://kerneltrap.org/man/linux/man2/openat.2 for an explanation.