Determine (from userspace) if two processes share the same struct file
 

Hi,

I'm working on building a tool that helps new systems programmers understand what file-related syscalls do. When a program hits a breakpoint, I want to generate some diagrams of the file descriptor tables, open file table, and vnode table for the running processes. I can get a lot of the info I need from /proc/*/fd and from lsof, but I can't tell when two file descriptors are referring to the *same* open file (e.g. they share the same cursor).

As a concrete example, say process A opens a file, then forks, producing process B. I can tell that both processes are referring the same file, but I can't tell whether file A and file B opened that file independently, or if they have the same underlying open file.

Reading through https://www.tldp.org/LDP/lki/lki-3.html, I understand what I need is to determine when two tasks share a particular `struct file`. However, I don't know if this data is exposed through any API to user space. Is there something I can look at to determine this? I'm guessing the answer is no, since `struct file` doesn't include anything like a unique ID, but I just want to make sure before I try doing something unnecessarily complicated.

Thanks!
Ryan

Heuristically, you could check if they have a parent-child (or perhaps ancestor) relationship and the same file offset. I believe the offset is in /proc/$PID/fdinfo/$FD, as "pos".

Not proof but a strong indication that they share the file table entry.