CS 468: Advanced UNIX Class 3

1. CS 468: Advanced UNIXClass 3 Dr. Jesús Borrego Regis University

2. Topics Update from last class Unix File System Systems Programming/File Management Homework 2 solutions Homework 3 Assignment Q&A

3. Update from last class • AVG for Linux • Linux scan tools • Linux LDAP tools • Many for Linux, Windows, Mac • Some provide Active Directory integration on Linux and Mac • Winaudit • Demo

4. AVG for Linux http://www.ihaveapc.com/wp-content/uploads/2011/07/AVG-for-Linux-001.png

5. Linux scan tools Portable Linux Auditing CD (PLAC): http://plac.sourceforge.net/ Linux Security Auditing Tool (LSAT): http://usat.sourceforge.net/ Tiger Security Auditing and Intrusion Detection Tool: http://www.nongnu.org/tiger/ OpenAudIT: http://www.open-audit.org/

6. Linux LDAP Explorer Tools http://ldaptool.sourceforge.net/

7. JXplorer http://jxplorer.org/

8. WinAudit G:\CS 468\Mercury.html

9. UNIX System Calls • File Management • Files: open, close, write, read, Directory (getdents) • Special • Sockets: internet sockets, accept, bind, connect, listen • mknod, ioctl, pipe • Process Management • Signals, nice, chdir, wait, exec, fork, exit, etc. • Error Handling • perror • See figures 13.1-13.3 in UPU

10. Error Handling Global variable errno stores cause of error (code) Initial value is set to 0 when the process is called If successful, variable is not changed If unsuccessful, errno is overwritten with value Subroutine perror translates into meaningful message Must include <errno.h>

11. Errno.h EPERM = 1  not owner ENOENT = 2  No such file or directory ESRCH =3  no such process EINTR = 4  interrupted system call EIO = 5  I/O error Example of usage on pages 434-435 in UPU

12. File Manipulation • Can access regular files, directories and special files: • Disk-based files • DVD, CD-ROM • USB • Terminals • Printers • IPC facilities (sockets, pipes)

13. File management • Open is used to open or create a file • If file is opened ok, open () returns a file descriptor • The file descriptor is a pointer to the file stream • Should close the file when no longer needed • System file descriptors (predefined): • 0 – standard input • 1 – standard output • 2 - standard error

14. File operations Open – opens old or creates new file Read – transfers bytes from file into buffer Write - transfer bytes from buffer to file Lseek – positions pointer to an offset in a file Close – closed old file Unlink – removes a file from the file system

15. Open parameters • File name: Absolute or relative path name • Mode: Bitwise OR of read/write flag • O_RDONLY – read only • O_WRONLY – write only (not used for input) • O-RDWR – read and write • O_APPEND – add after file pointer • O_CREAT – create if it does not exist • O_EXCL – fail if file exists • O_NONBLOCK – used for pipes • O_TRUNC – truncate to zero bytes if exists • Permissions – umask (Ch. 4, p. 178-9)

16. File Operations examples Create – p. 446 Read – pp. 446-447 Write – pp.447-448 Lseek – pp. 448-450 Close – p. 450 Unlink – p. 450

17. Monitor program Program code provided in the book If we want to keep track of changes to a file, we can invoke the monitor program Will display information about files modified since the last scan Example: pp. 451-452 Displays additions, modifications, deletions in a directory Status of files is stored in a stats table

18. Other file functions getdents – gets information about a directory chown and fchown – changes file owner chmod, fchmod – changes file permissions dup, dup2 – duplicates a file descriptor fcntl – grants access to file characteristics truncate, ftruncate – shortens a file ioctl – controls a device link – creates a hard link mknod – makes a special file

19. UNIX special files • Provides interfaces to files to make them look like regular files • Directory files • Device files • Sockets • Pipes • Printers • Zip files

20. Streams I/O facilities that expand the file system Can be used to add device drivers to kernel Can provide interfaces to the network drivers We can create streams to view web page code, for example

22. Input/Output Objects • Regular file • Directory File • Special File • Pipe • Named Pipe and Unnamed pipe • Socket • Peripheral • Buffered: tape, disk • Unbuffered: tape, terminal

23. I/O Buffering Buffer pool – collection of buffers used to cache When a read is required, the data is moved to a buffer and then to the process’ address space Subsequent reads obtain data from buffer Writes to items in buffer pool made without I/O When process ends, system uses delayed writes

24. Directory file I/O • Directories are different than regular files • Can only be created using mknod or mkdir • mknod creates d irectory, named pipe, or special file • Can only be read using getdents • Can be modified with use of link • link adds a hard link into a directory • Hard links are names that refer to the same file • Retain same contents in both files • Can make it difficult to track files • Prefer to use symbolic (soft) links – like a shortcut • Do no retain data

25. Disk Architecture Platter – the plate Tracks – concentric circles Sectors – pie slices Block – sector and track intersection Read write head positioning Cylinders Disk transfer time Interleave – p. 575

26. inodes • For regular file or directories • Location of disk blocks • For special files • Information to locate the peripheral • Contains permission flags, owner, group, modification time. • Has fixed size and can contain pointers to indirect pointers

27. Contents of inode Type of file File permissions Owner and group ids Hard link count Last modification and access time Location of the blocks Major and minor device numbers Symbolic link Displayed when ls –l is executed

28. Large files If the file is small, it can be contained in the inode (< 40K) If the file is more than 1- blocks, an indirect block is used (p. 578) See file system layout on page 579 Superblock contains information about the entire file system (p. 580)

29. Superblock contents • Total number of blocks in the file system • Number of inodes in the inode free list • Size of blocks in bytes • Number of free blocks • Number of used blocks • List of bad blocks • Contained in a single bad file • In inode2 identifies the root directory blocks

30. To open a file • Must retrieve the inode from the pathname • If path is absolute, start from inode 2 • If path is relative, search from pwd • Components of path are processed from left to right • Every component (except last) must be a directory of symbolic link

31. Mounting files • When UNIX starts, the directory hierarchy is taken from the root device • Can mount other file systems to the original hierarchy • The typical UNIX hierarchy consists of many devices, each as a subtree of the total hierarchy • To mount a subdirectory, use mount command • $ mount /dev/flp /mnt • Mounts /dev/flp under the /mnt subdirectory • To detach, unmount

32. Special file I/O • All peripherals have device drivers • The peripheral device driver supplies the peripheral’s interface • Two types: • Block oriented – I/O made using blocks of data • Character oriented – I/O on a character by character basis • Typically, peripherals provide both types

33. Major/Minor numbers Used to locate the device driver associated with the device Major number specifies particular device driver Minor specifies which of many will be used Used to index into switch tables to locate the correct driver See page 618 (UPU) for sample switch table

34. Terminal I/O • Similar to peripherals • Terminal device drivers must support special different kinds of pre-/post-processing of I/O • Each kind is called a line discipline: • Raw mode – no processing at all • Cbreak mode – Control characters (S- and –Q for flow control, -C to terminate) • Cooked (canonical) mode – full processing available (backspace, delete, etc., until Return is pressed)

35. Terminal Data Structures clists – linked lists of fixed size character arrays. Used to buffer preprocessed input, post processed input, and output associated with the terminal tty structures – contain the state of the terminal, pointers to clists, currently selected discipline, list of characters to be processed, and options set by ioctl. Only one tty structure per terminal

36. File System Maintenance • fsck – check the integrity of the file system • df – displays used and available disk space • du – displays kbytes or 512-byte blocks allocated to the filenames (total with –s) • mkfs – creates a new file system • Available to root

38. UNIX file system Comprised of four components A named space – the hierarchy An API – used to manage, navigate and manipulate objects A security model – protects, hides, shares An implementation – software to link logical model to the actual hardware implementation

39. File systems NFS & CIFS forward requests to another machine Default: ext3 and ext4 Sun’s ZFS, Veritas’ VxFS, ReiserFS, IBM’s JFS Microsoft’s FAT and NFS ISO 9660 for CD ROMs

40. Pathnames • The file system appears as a single unified hierarchy starting at the root: / • Windows separates into partitions and drives • Absolute path – starting from the root • Relative path – from current directory • File names can have alpha characters and numbers, but no slashes • If spaces are present, enclose in quotation marks

41. Detaching file systems • Unmount detaches a file system that is not in use • To avoid errors, use fuser command to see if processes are holding references to the file system • For example: • fuser –c /usr • Prints the PID of every process using the file system (file or directory), plus letter codes to show the nature of the activity

43. File Tree Organization We can use various incompatible naming conventions simultaneously UNIX file system is too disorganized The root file system includes root directory and few files and subdirectories The OS kernel is somewhere else, distribution dependent

46. File Types • Seven types: • Regular files • Directories • Character device files • Block device files • Local domain sockets • Named pipes (FIFO/FCFS) • Symbolic links • Command ls –ldshows the types

48. Character and block device files • Device drives provide standard interface to emulate a regular file • When system receives a request, it forwards it to the appropriate device driver • Character device files allow associated drivers perform their own I/O buffering • Block device files are used to handle large amounts of data and want the kernel to buffer for them

49. Local domain sockets Sockets are like ports in a computer, and allow communication among processes Local domain – accessible from local host Visible from the file system instead of network Created with socket system call and removed with rm or unlink

50. Named pipes Similar to sockets – provide communication between two processes on same host Not used frequently, since local domain sockets perform the same functionality Created with mknod and removed with rm