What's eating gilbert pid? (kevent NOTE_FORK and pids question)
What's eating gilbert pid? (kevent NOTE_FORK and pids question)
- Subject: What's eating gilbert pid? (kevent NOTE_FORK and pids question)
- From: Derrick Brashear <email@hidden>
- Date: Fri, 19 Feb 2010 12:45:07 -0500
I want to track forked children of a given pid. For the purpose of
this discussion, I am userspace code (I could be kernelspace code if
it helped)
Best bet would seem to be NOTE_FORK kevents. I can't have NOTE_CHILD
or use NOTE_TRACK, as I get ENOTSUP. I have no visibility into it, but
this list from 2007 suggests that's rdar://problem/3439519
Ok, fine. NOTE_FORK gets OR'd with the child pid, right?
kern_exec.c: proc_knote(p->p_pptr, NOTE_FORK | p->p_pid);
kern_fork.c: proc_knote(parent_proc, NOTE_FORK | child_proc->p_pid);
kern_fork.c: proc_knote(parent_proc, NOTE_FORK | child_proc->p_pid);
So I'd expect:
event[0].filter = EVFILT_PROC;
event[0].flags = EV_ADD | EV_ENABLE;
event[0].fflags = NOTE_EXIT | NOTE_FORK | NOTE_EXEC;
kevent(kq, NULL, 0, event, 1, NULL);
to give me a child in a NOTE_FORK
Instead, event[0].data is unset, and event[0].fflags is *solely* NOTE_FORK.
I can see nowhere in the kernel where NOTE_PDATAMASK is masked off.
If I can really not have this, Launchd seems to use a sysctl to
enumerate children on a fork:
int mib[] = { CTL_KERN, KERN_PROC, KERN_PROC_ALL, j->p };
(KERN_PROC_PPID seems to not be implemented in xnu-1456.1.26)
Am I really reduced to this? It seems very likely to be racy.
--
Derrick
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Darwin-dev mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:
This email sent to email@hidden