Question

I’m looking for the implementations of open(), close(), write() and unlink(), but I can’t find them anywhere! Every function I find is like sys_open, do_open, etc_open… but nothing with the interface we use. Can you help me?

I need to discover what kind of security checks they make

Answer 1

You need to look for SYSCALL_DEFINE macro in kernel sources. For example, grepping for unlink at /fs gives the following:

$ grep -r -n SYSCALL_DEFINE *.c | grep unlink

namei.c:2811:SYSCALL_DEFINE3(unlinkat, int, dfd, const char __user *, pathname, int, flag)
namei.c:2822:SYSCALL_DEFINE1(unlink, const char __user *, pathname)

Note that the number after SYSCALL_DEFINE is the syscall argument count.