flock¶

Intro¶

flock - applies or removes an advisory lock on an open file

Description¶

The flock() system call applies or removes an advisory lock on an open file. A lock is associated with an open file description (see open(2)). An open file description locks a file against access by other open file descriptions. Locks are established on a per open file description basis; these locks are unrelated to locks associated with the underlying inode.

A call to flock() may block if an incompatible lock is held by another process. A nonblocking form of flock is defined in fcntl(2).

Arguments¶

fd: int[K] - file descriptor of the file to lock/unlock
operation: int[K] - type of lock to perform (FLOCK_SH, FLOCK_EX, FLOCK_UN, etc)

Available Tags¶

K - Originated from kernel-space.

Hooks¶

sys_flock¶

Type¶

Kprobe + Kretprobe.

Purpose¶

Identify when processes are locking files.

Example Use Case¶

This event can be used to analyse how long it takes a process to get a lock, and also uncover cases of deadlocks.

Issues¶

Since this is an advisory lock, if a process tries to get a lock on a file that another process already has a lock on, the second process will block until the lock is released, but there is no guarantee that the first process won't modify the file before the second process can acquire the lock.

fcntl - interfers with asynchronous input and output operations, file descriptor flags, and lock types
open - creates or opens a file or devices

This document was automatically generated by OpenAI and needs review. It might not be accurate and might contain errors. The authors of Tracee recommend that the user reads the "events.go" source file to understand the events and their arguments better.