tools/filegone: Support file path

Support for file paths using path_helpers.

For example:

    $ realpath .
    /home/sdb/Git/bcc/build
    $ touch a.out && sleep 0.2 && mv a.out b.out && sleep 0.2 && rm b.out

    $ sudo ./filegone.py -P
    TIME     PID     COMM   ACTION FILE
    21:22:37 58683   mv     RENAME /home/sdb/Git/bcc/build/a.out > /home/sdb/Git/bcc/build/b.out
    21:22:37 58685   rm     DELETE /home/sdb/Git/bcc/build/b.out

Signed-off-by: Rong Tao <[email protected]>

Author: Rtoax

tools/filegone.py

@@ -11,6 +11,7 @@
 # 08-Nov-2022 Curu. modified from filelife
 # 19-Nov-2022 Rong Tao Check btf struct field instead of KERNEL_VERSION macro.
 # 05-Nov-2023 Rong Tao Support rename/unlink failed situation.
+# 01-Jul-2025 Rong Tao Support file path
 
 from __future__ import print_function
 from bcc import BPF
@@ -20,6 +21,7 @@
 # arguments
 examples = """examples:
     ./filegone           # trace all file gone events
+    ./filegone -P        # show file path
     ./filegone -p 181    # only trace PID 181
 """
 parser = argparse.ArgumentParser(
@@ -28,6 +30,8 @@
     epilog=examples)
 parser.add_argument("-p", "--pid",
     help="trace this PID only")
+parser.add_argument("-P", "--path", action="store_true",
+    help="show file path")
 parser.add_argument("--ebpf", action="store_true",
     help=argparse.SUPPRESS)
 args = parser.parse_args()
@@ -37,21 +41,33 @@
 bpf_text = """
 #include <uapi/linux/ptrace.h>
 #include <linux/fs.h>
+#include <linux/fs_struct.h>
 #include <linux/sched.h>
+#ifdef FULLPATH
+INCLUDE_FULL_PATH_H
+INCLUDE_PATH_HELPERS_BPF_H
+#endif
 
 struct data_t {
     u32 pid;
     u8 action;
     char comm[TASK_COMM_LEN];
-    char fname[DNAME_INLINE_LEN];
-    char fname2[DNAME_INLINE_LEN];
+    u32 path_depth, path_depth2;
+#ifdef FULLPATH
+    FULL_PATH_FIELD(fname);
+    FULL_PATH_FIELD(fname2);
+#else
+    char fname[NAME_MAX];
+    char fname2[NAME_MAX];
+#endif
 };
 
 struct entry_t {
     u32 pid;
     u8 action;
     struct {
         char name[DNAME_INLINE_LEN];
+        struct dentry *dentry;
     } old, new;
 };
 
@@ -79,6 +95,7 @@
 
     entry.pid = pid;
     entry.action = 'D';
+    entry.old.dentry = dentry;
     get_dentry_name((char **)&entry.old.name, dentry);
 
     currentry.update(&tid, &entry);
@@ -103,7 +120,9 @@
      * Couldn't get new and old dentry name in trace_return(), because you'll
      * get new-name for old.
      */
+    entry.old.dentry = old_dentry;
     get_dentry_name((char **)&entry.old.name, old_dentry);
+    entry.new.dentry = new_dentry;
     get_dentry_name((char **)&entry.new.name, new_dentry);
 
     currentry.update(&tid, &entry);
@@ -138,9 +157,33 @@
 
     bpf_probe_read(&data->fname, sizeof(data->fname), entry->old.name);
 
+    data->path_depth = data->path_depth2 = 0;
     if (entry->action == 'R')
         bpf_probe_read(&data->fname2, sizeof(data->fname2), entry->new.name);
 
+#ifdef FULLPATH
+    struct task_struct *task;
+    struct fs_struct *fs;
+    struct vfsmount *cwd_vfsmnt;
+
+    task = (struct task_struct *)bpf_get_current_task_btf();
+    bpf_probe_read_kernel(&fs, sizeof(fs), &task->fs);
+    bpf_probe_read_kernel(&cwd_vfsmnt, sizeof(cwd_vfsmnt), &fs->pwd.mnt);
+    if (data->fname[0] != '/') {
+        data->path_depth = 1;
+        bpf_dentry_full_path(data->fname + NAME_MAX, NAME_MAX, MAX_ENTRIES - 1,
+                             entry->old.dentry->d_parent, cwd_vfsmnt,
+                             &data->path_depth);
+    }
+
+    if (entry->action == 'R' && data->fname2[0] != '/') {
+        data->path_depth2 = 1;
+        bpf_dentry_full_path(data->fname2 + NAME_MAX, NAME_MAX, MAX_ENTRIES - 1,
+                             entry->new.dentry->d_parent, cwd_vfsmnt,
+                             &data->path_depth2);
+    }
+#endif
+
     events.ringbuf_submit(data, sizeof(*data));
     return 0;
 }
@@ -192,6 +235,17 @@ def action2str(action):
     bpf_text = bpf_text.replace('TRACE_VFS_RENAME_FUNC', bpf_vfs_rename_text_old)
     bpf_text = bpf_text.replace('TRACE_VFS_UNLINK_FUNC', bpf_vfs_unlink_text_1)
 
+if args.path:
+    bpf_text = "#define FULLPATH\n" + bpf_text
+
+    with open(BPF._find_file("full_path.h".encode("utf-8"))) as fileobj:
+        progtxt = fileobj.read()
+    bpf_text = bpf_text.replace('INCLUDE_FULL_PATH_H', progtxt)
+
+    with open(BPF._find_file("path_helpers.bpf.c".encode("utf-8"))) as fileobj:
+        progtxt = fileobj.read()
+    bpf_text = bpf_text.replace('INCLUDE_PATH_HELPERS_BPF_H', progtxt)
+
 # NOTE: After bpf_text modification
 if debug or args.ebpf:
     print(bpf_text)
@@ -214,10 +268,20 @@ def action2str(action):
 def print_event(cpu, data, size):
     event = b["events"].event(data)
     action_str = action2str(event.action)
-    file_str = event.fname.decode('utf-8', 'replace')
-    if action_str == "RENAME":
-        file2_str = event.fname2.decode('utf-8', 'replace')
-        file_str = "%s > %s" % (file_str, file2_str)
+    if args.path:
+        import os
+        import sys
+        sys.path.append(os.path.dirname(sys.argv[0]))
+        from path_helpers import get_full_path
+        file_str = get_full_path(event.fname, event.path_depth)
+        if action_str == "RENAME":
+            file2_str = get_full_path(event.fname2, event.path_depth2)
+            file_str = "%s > %s" % (file_str, file2_str)
+    else:
+        file_str = event.fname.decode('utf-8', 'replace')
+        if action_str == "RENAME":
+            file2_str = event.fname2.decode('utf-8', 'replace')
+            file_str = "%s > %s" % (file_str, file2_str)
     print("%-8s %-7d %-16s %6s %s" % (strftime("%H:%M:%S"), event.pid,
         event.comm.decode('utf-8', 'replace'), action_str, file_str))
 

tools/filegone_example.txt

@@ -13,14 +13,17 @@ For example:
 
 USAGE message:
 
-usage: filegone.py [-h] [-p PID]
+# ./filegone -h
+usage: filegone.py [-h] [-p PID] [-P]
 
 Trace why file gone (deleted or renamed)
 
-optional arguments:
-  -h, --help         show this help message and exit
-  -p PID, --pid PID  trace this PID only
+options:
+  -h, --help     show this help message and exit
+  -p, --pid PID  trace this PID only
+  -P, --path     show file path
 
 examples:
     ./filegone           # trace all file gone events
+    ./filegone -P        # show file path
     ./filegone -p 181    # only trace PID 181