#include #include #include /* This was all theoretical, I could never get it to work on my box, but the theory is the same. I'm grabbing all processes with the task_struct defined in sched.h. I use the fancy for loop to go through each process because the macro for_each_process is busted for whatever reason and GCC hates it. While looping through each process, I decalre a file struct from the task struct and use it to retrieve the file open file descripts table with fd_array() which holds them. I test said array for a third element. If there is an element in that array, then my if statement is satisfied and I print out info about the process. */ int init_mod(void) { struct task_struct *task; for (task = &init_task ; (task = next_task(task)) != &init_task ; ) { printk(KERN_CRIT "For this one: %s %d\n",task->comm, task->pid); int j =0; struct dentry *dentP = NULL; struct file *fileP = NULL; struct files_struct *file_struct = NULL ; file_struct = task->files; if ( file_struct ) { if ( file_struct->fd_array[3]!=NULL ) /* if the file descriptor array is (starting at 0) has something in its 4th array slot, then it has more than 3 descriptors. The first is always stdin, second is stdout, third is usually stderr. /* { fileP = file_struct->fd_array; for ( j =0; j < NR_OPEN_DEFAULT; j++ ) { if (fileP) { printk("This process has 3 or more open file descriptors!\n"); printk("owner = [%d]\n",fileP->f_uid); printk("group = [%d]\n",fileP->f_gid); } fileP++; } } } return 0; } void cleanup(void) { printk(KERN_CRIT "Bye bye!\n"); }