Getting the actual executable path of current process context - Linux kernel - c

Question

I'm trying to get the actual executable path of a running process through my kernel driver.
I've done the following:
static struct kretprobe do_fork_probe = {
.entry_handler = (kprobe_opcode_t *) process_entry_callback,
.handler = (kprobe_opcode_t *) NULL,
.maxactive = 1000,
.data_size = 0
};
do_fork_probe.kp.addr = (kprobe_opcode_t*)kallsyms_lookup_name("do_fork");
if ((ret = register_kretprobe(&do_fork_probe)) < 0)
return -1;
static int process_entry_callback(struct kretprobe_instance *ri, struct pt_regs *regs)
{
printk("Executable path = %s\n", executable_path(current));
return 0;
}
The executable_path function:
char* executable_path(struct task_struct* process)
{
#define PATH_MAX 4096
char* p = NULL, *pathname;
struct mm_struct* mm = current->mm;
if (mm)
{
down_read(&mm->mmap_sem);
if (mm->exe_file)
{
pathname = kmalloc(PATH_MAX, GFP_ATOMIC);
if (pathname)
p = d_path(&mm->exe_file->f_path, pathname, PATH_MAX);
}
up_read(&mm->mmap_sem);
}
return p;
}
The problem is that if I run an executable using bash as follows:
./execname
I'm getting the following output:
Executable path = /bin/bash
While what I really want is the : execname (Actually its full path but lets start with the name)
Any suggestions?

Answer 1

It is unclear what you try to get, so here are list of options:
execname as it is considered by SystemTap. Simple process->comm should suffice. That is how comm field defined in Kernel:
char comm[TASK_COMM_LEN]; /* executable name excluding path
- access with [gs]et_task_comm (which lock
it with task_lock())
- initialized normally by setup_new_exec */
But if bash is a symlink, than comm should contain symlink's name, not the real executable name.
argv[0] first element of command line arguments array as it seen my application (and may be altered by it). There is a get_cmdline() function in kernel, but it seem not to be exported.
Basename of full path. In this case, do not call d_path, just take d_name field of dentry:
strlcpy(pathname, mm->exe_file->f_path->d_name, PATH_MAX);
But it sounds like a XY problem. You trying to get executable names for all forking processes? Why not use SystemTap directly?
# stap -v -e 'probe scheduler.process_fork { println(execname()); }'