Print all open()ed files on the system

open_hook.py

from kernel_ffi import kprobe, KP_ARGS_WATCH, str as s
from struct_access import partial_struct

filename = partial_struct("filename")

def do_filp_open_hook(dfd, fn):  # don't have to receive all args if you don't need
    print("do_filp_open: fd {} name {!r}".format(dfd, s(int(filename(fn).name))))

kp = kprobe("do_filp_open", KP_ARGS_WATCH, do_filp_open_hook)

# when you're done:
kp.rm()
# if kp goes out of scope, the gc finalizer will also remove it.